PANews reported on February 22 that Binance co-founder CZ posted some thoughts on the recent hacker attack on the X platform. He said:
There is a pattern where hackers were able to steal large amounts of cryptocurrency from multi-signature “cold storage” solutions such as ByBit, Phemex, WazirX, and others.
In the recent ByBit case, the hackers were able to make the front-end UI show a legitimate transaction, while the actual signature was for another transaction. Not familiar with the other cases, but based on the limited information available, they sound similar. Even scarier, the affected exchanges used different multi-signature solution providers. The hacker Lazarus Group's intrusion capabilities are very advanced and wide-ranging, and it is unclear whether the hackers were able to hack into multiple signature devices, the server side, or in every case.
Some have questioned my suggestion to stop all withdrawals as a standard security precaution (I tweeted this on the shuttle to the plane), the purpose was to share a practical approach based on personal experience and observation, but there is no absolute right or wrong approach, the guiding principle is always to lean on the safe side. After any security incident, pause everything, make sure we fully understand what happened, how the hackers got into the system, which devices were compromised, double-check that everything is secure, and then resume operations.
Of course, suspending withdrawals could cause more panic. In 2019, Binance suspended withdrawals for a week after a massive $40 million hack, and when withdrawals (and deposits) were restored, more deposits were made than withdrawals. It’s not that this is a better approach. Every situation is different. It’s a matter of judgment, and the tweets are meant to share what might work, to show support in a timely manner, and to trust that Ben made the best decision based on the information he had. Ben has done an excellent job of communicating transparently and staying calm while dealing with challenges. This is in stark contrast to other less transparent CEOs (such as WazirX, FTX, etc.). The cases mentioned here are different. FTX is a fraud. WazirX, due to ongoing litigation, will not comment.
