Dialogue CZ: After Binance was hacked, what was I thinking?

Guest: CZ, Founder of Binance

Host: Jacquelyn Melinek

Compiled by: Jiahua, ChainCatcher

Source: Talking Tokens

After Binance faced a hacker attack of approximately $6.3 billion, CZ accepted an interview with Talking Tokens, reflecting on his reaction upon learning about the theft, discussing Binance's crisis management, user fund flow, AI security risks, and the possibility of industry-wide collective defense.

CZ stated that he no longer directly manages Binance, so after the incident, he was mainly responsible for communicating information to the community. He believes that both Binance and the entire cryptocurrency industry are not investing enough in security. As AI capabilities increase, the speed of attacks may continue to accelerate, and the industry needs to collaborate with AI companies and promote the establishment of a security alliance.

Key Insights Summary

• Preparing to sleep when learning about the theft: CZ mentioned that it was nearly midnight in the UAE, and he learned about the attack almost simultaneously from the Binance team and on X. Since he no longer directly manages Binance, he focused on community sentiment and quickly communicated the information he had.

• Acknowledging insufficient security investment: CZ believes that both Binance and the entire cryptocurrency industry are not investing enough in security. Companies tend to relax their vigilance after a long period without security incidents, and attacks often expose previously overlooked issues.

• AI accelerates attacks but can also be used for defense: CZ believes that malicious actors have already begun to utilize AI, while the industry has not yet acquired sufficient AI defense capabilities in a timely manner. More security issues may arise in the short term, but in the long run, AI is expected to help make cryptocurrency platforms and software more secure.

• Promoting the establishment of an industry security alliance: CZ stated that there have been discussions in the industry about establishing a security alliance to allow participants to share best practices, conduct cross-audits, and assist in quickly freezing funds after incidents occur. He hopes to contribute to promoting this mechanism, but the specific form has yet to be determined.

• Hoping for government assistance: When asked if he had communicated with Trump or Washington regarding this incident, CZ stated that he had not contacted them about this event but hopes that governments capable of communicating with North Korea, such as the United States and China, can provide assistance.

• Responding to market and fund flow: CZ believes that Binance's swift commitment to cover losses alleviated market concerns about a chain reaction. He also mentioned that only about 6% to 10% of the outflowing funds went to other centralized exchanges, but did not specify the source of this data during the interview.

• Advice for ordinary users: CZ advises users to understand different asset custody tools, learn how to protect their assets, and stay updated on security information. He believes that both self-custody and platform custody have their own risks that need to be managed.

Preparing to sleep when learning about the Binance theft

Host: Last Thursday, Binance experienced a hacker attack of approximately $6.3 billion. The FBI attributed this attack to the North Korean hacker group TraderTraitor. Before discussing these issues, I want to go back to last Thursday: how did you learn about the news, and what were you doing at the time? Had you ever thought such a thing could happen?

CZ: At that time, it was almost midnight in the UAE, and I was preparing to sleep while scrolling through X. The team informed me that Binance was experiencing a hacker attack. Around the same time, I also saw related news on X, but I wasn't sure if it was true. The news quickly woke me up; to be honest, I was a bit shocked.

However, when you run a cryptocurrency exchange, you always know that security incidents can happen at any time; you can't completely rule out that possibility. The key is to handle it as quickly as possible after it occurs. I believe that response speed and protecting users are very important. Typically, in such situations, you need to manage two lines simultaneously: one is to control and fix the problem, preventing the attack from spreading further; the other is to ensure that users do not panic and to avoid causing broader market panic.

I no longer manage Binance, so I did not directly participate in the internal handling of the company. However, I have many followers on X and a certain influence in the cryptocurrency industry. Therefore, I focused more on community sentiment and tried to communicate what I knew to the community in a quick and transparent manner.

Host: Many people believe that Binance and your response were very swift. In the past, during other hacker attacks or similar incidents in the industry, we might not have seen such a response. After experiencing this attack, what is your biggest reflection?

CZ: Looking back over the past few days, I believe there are definitely many areas for improvement, and many issues could have been prevented. All hacker attacks are preventable, so there is still a lot of room for improvement. Companies tend to become complacent over time: security incidents don't happen until they suddenly do. But before that, there are often some things that have been overlooked. If enough energy and attention are invested, security incidents can be prevented. There are many lessons to be learned from this incident.

Hacker attacks are not just a problem for one company

Host: The FBI stated that this attack came from North Korean state-sponsored hackers. So, when companies consider North Korean hackers, are they facing a corporate security issue, or has it become a national security issue, or even a global security issue?

CZ: I believe all three are true because there are no clear boundaries between these levels. For companies, this is certainly a significant issue. Moreover, it’s not just Binance; every cryptocurrency company, every cryptocurrency platform, and every cryptocurrency protocol needs to face this issue. The traditional financial system is the same; North Korean hackers also attack banks, and they have been known for attacking banks in the past.

What happens in the cryptocurrency industry today can also impact the global economy. The global financial system is becoming increasingly intertwined with the cryptocurrency industry. There are now tokenized stocks, RWAs, and stablecoins linked to government short-term bonds, all of which are interconnected. Therefore, when such large-scale issues occur in the cryptocurrency industry, they can also affect the real economy in other sectors.

You cannot simply say this is a problem for one company or a specific industry. It affects companies, industries, and it will also impact the global financial system. Given the scale of the impact, it certainly also involves national security.

Technology is not yet fully mature; how to embrace large-scale adoption?

Host: More and more funds are flowing onto the blockchain, and more people and institutions want to enter this field, but hackers are also looking for opportunities. Banks are also attacked, but is the cryptocurrency industry really ready for large-scale adoption now?

CZ: I think this is a chicken-and-egg problem. Without adoption, there may not be enough funds invested in technology, so demand and supply need to grow simultaneously. You can't wait until technology is 100% mature before you start using it, and there is no state of 100% maturity; technology is always improving.

AI is developing very rapidly and has brought many security issues. In the past, we might see an attack once a month or every so often; now, for a period, we see attacks every week, and just yesterday, there were four different attacks. As AI capabilities increase, the speed of attacks will also accelerate.

At the same time, we must use AI more for defense. The only way to fight a monster is, to some extent, to become that monster, so we do need to use AI capabilities for defense. There is no perfect moment to say that technology is mature; it is always evolving.

Conversely, if we cannot control these security incidents and let them keep happening without seeing improvements, then the pace of adoption will slow down, which will affect the entire industry. But any new technology needs to go through an adaptation period, and the process can be painful. I believe that positive forces will ultimately prevail, and the situation should improve over time. I don't know where the low point or turning point is, and before the overall improvement, we may still see more issues, but I hope we can reach that point soon.

No communication with Trump regarding the theft incident; hoping for government assistance

Host: President Trump stated on October 31 that he did not yet know whether the attack came from North Korea, but if it did, he would communicate with North Korea about it. Now that the FBI has made an attribution, what do you think? What actions do you hope Washington will take? Have you spoken with President Trump?

CZ: I have not communicated with President Trump or anyone in Washington regarding this incident. We certainly hope to receive their assistance; I personally, Binance, and the entire cryptocurrency industry hope to receive help from the U.S. government. If anyone can communicate with North Korea, it might only be one or two governments, like the U.S. and China. So, as long as we can get help, we welcome it.

In one video clip I saw, President Trump seemed to be attending a gathering, and someone casually asked him a question, to which he responded. I think that statement shouldn't be taken too formally; it wasn't a statement released through formal procedures. However, I know that President Trump would try to solve the problem. In any case, I have not communicated with him, but we hope to receive help.

Hoping to promote the establishment of an industry security alliance

Host: There are some rather pessimistic views now. Some have mentioned "Black October," warning that banks and other large institutions are becoming targets for AI attacks. After experiencing the Binance theft incident, what advice would you give to others? How do you think they should rethink security issues?

CZ: For any cryptocurrency company, financial company, or any company with security needs, which is almost all companies, they must closely monitor and utilize AI technology. Companies should also consider collaborating with AI companies to address the security issues brought by AI.

In the early days of the internet, there were similar situations. New viruses kept emerging, and antivirus software sold very well as a result. Attacks and defenses have always occurred simultaneously. Today, malicious actors are using AI to do bad things. AI is developing very quickly, with many open-source models, and different countries have different models. Even closed-source models can be deceived, leading to their use in attacks. Therefore, we must use AI for defense on a large scale.

Frankly, I believe that the AI industry and AI companies have not yet figured out how to provide defense capabilities quickly enough before attack capabilities emerge. We have had many discussions around this issue. I believe it is a solvable problem and will ultimately be resolved, but the industry must closely collaborate with these technology providers. There have already been some in-depth discussions.

As an industry, we also need to respond collectively. There have been several discussions suggesting the establishment of some form of industry security alliance, allowing everyone to learn from each other's mistakes, share best practices, conduct cross-audits, and assist in quickly freezing funds when incidents occur. Given what has happened over the past few months, I believe this alliance may be established relatively quickly. I don't know what form it will ultimately take, but I hope to play a role in helping this happen.

CZ: AI will make cryptocurrency platforms safer in the long run

Host: You previously mentioned that the industry may be approaching the bottom of "Black October" or this concerning period, hoping for an upward turning point afterward. What developments in Binance, the cryptocurrency industry, and AI are you optimistic about?

CZ: From a medium to long-term perspective, I firmly believe that AI will make the cryptocurrency industry, platforms, and software more secure. AI can uncover some very hidden issues. We are currently under attack, which is indeed painful, but it also gives us the opportunity to build defenses. Overall, it will make systems more secure, although the process is quite painful.

AI is also accelerating the pace of development in software and other fields, primarily still in software, which will enhance the speed of technological advancement. There is even discussion in the industry that AI might discover vulnerabilities in blockchain software before quantum computing can crack encryption technologies. As issues are exposed, the industry must continuously evolve and become stronger.

In addition, AI will facilitate transactions at a speed far beyond what we have seen in the past, and the only financial technology that can support this transaction speed is blockchain. So, I am very optimistic about the future, even though everyone has been quite worried in the past few days. But considering the situation at the time, I think Binance handled it relatively well; Binance covered all losses, and users did not suffer any losses.

Host: Do you also remain bullish about the future of the market?

CZ: I don't want to predict prices, nor am I providing financial advice. There is a lot of discussion on X that the market needs to experience a significant blow to hit the bottom, and once it hits the bottom, it can only go up from there. I'm not saying the market will rise tomorrow; that's hard to predict, but I am indeed very optimistic about the future.

Why didn't the market experience a larger shock after Binance was hacked?

Host: The market's reaction to this attack seems to be minimal. Prices dropped slightly, but the changes were not as significant as expected.

CZ: I think this is where communication is very important. I and Binance quickly stepped up to state: user funds were not affected, and user funds are safe. This statement is simple but helps to prevent a chain reaction. Everyone understands that this time it won't be like the bankruptcy situations of some other platforms or lending protocols, where users bear the losses, nor will there be a second or third round of impact.

This first calmed everyone down. Secondly, you need to have enough credibility for people to believe what you say. Many things are evident on-chain. Looking back at some of the collapses in 2022, those institutions borrowed money from elsewhere and withdrew funds from different platforms, and people could see that.

But in this incident, everyone knew that Binance had the financial capacity to cover the losses. Binance has the SAFU fund, futures insurance fund, and a very strong balance sheet. The quick response, along with taking responsibility, covering user losses, and protecting users, calmed everyone down.

Interestingly, when the incident occurred on Thursday, the decline in the cryptocurrency market was even less than that of the tech stock market, which is almost unheard of. Typically, when the stock market declines, the cryptocurrency market drops even more because people want to hold cash and sell off crypto assets. But on that day, despite such a significant attack on the crypto industry, the market's decline was smaller. So, I believe everyone remained calm, and the trust built over the years is quite solid, which I am proud of.

Where will the funds go after users withdraw?

Host: Binance announced earlier today that for the first time since the attack, there was a single hour where deposits exceeded withdrawals. This seems to illustrate the trust issue you just mentioned.

CZ: It is normal to see withdrawals after such incidents. The platform will pause withdrawals, and some large institutions have policies requiring them to withdraw funds, while some retail investors will follow suit. But after the withdrawals, the question is: where will I put my money to be safer?

At Binance, user funds did not suffer losses due to this incident because Binance covered the losses. The incident occurred at Binance, which of course can be frightening, but where should the funds go next? Recently, several hardware wallets have also experienced security incidents, one involving a supply chain attack and another involving mnemonic phrase generation.

In these situations, users may not have done anything wrong. They followed standard procedures, purchased hardware wallets, or generated mnemonic phrases themselves, but years later they could still lose funds, and it’s not their fault, and no one will bear the losses. Whereas if the funds are kept at Binance, the losses are borne by Binance.

Users can also choose smaller platforms. They are not the primary targets for attacks and may not be hit in the first wave. But now that Binance has been attacked and has fixed the issues, the next wave of attacks may turn to smaller platforms. In my view, Binance is now safer.

Some people, after withdrawing, will find that they need to back up their mnemonic phrases. Some say that less than 10% of the outflow went to other centralized exchanges, with about 6% to 10% flowing into users' self-custody wallets. This means that most of the funds may have been transferred to users' own self-custody wallets. However, using self-custody wallets requires backing up mnemonic phrases and ensuring they do not get damaged or lost. Many people lose funds while self-custodying, not even because of hackers.

So, after comparing, people may choose to put their funds back into Binance. I just saw a post stating that in less than 24 hours, Binance experienced a net inflow in a single hour. I believe this reflects the strength of the platform and the trust of the users. In the coming weeks or months, fund flows will definitely fluctuate, but if the market enters a bull market, we may see more deposits.

Binance and the entire industry are not investing enough in security

Host: Binance has released many announcements, and you have also posted quite a bit. Finally, is there anything you haven't shared on social media that you want everyone to know?

CZ: Technology is developing very quickly, especially AI. Its growth is so rapid that this exponential growth is hard for people to truly understand. I believe that Binance and the entire industry are not investing enough in security. Frankly speaking, many AI security tools are not yet available to the industry.

I hope everyone invests more in these areas, including increasing security engineers, using more AI tools, and closely collaborating with AI security service providers. These are all very critical.

For ordinary users, I advise everyone to understand different tools, learn how to protect their assets, and stay updated with the news. I know it may feel like there is no absolutely safe place right now, but I believe the situation will gradually improve. During this turbulent period, we must remain vigilant and take protective measures seriously.