Summary of Viewpoints
1. Frequent security vulnerabilities break the industrys security illusion
Bybit had $1.4 billion stolen and Infini had $50 million stolen. The successive large-scale hacker attacks exposed the vulnerability of industry security.
Exchanges, wallet providers, and industry regulators are all responsible for security, but the industry currently lacks unified security standards.
Cold wallets are not absolutely safe, and security vulnerabilities often come from human operations and negligence in system permission management.
2. Market sentiment fluctuated violently, and industry self-help and regulatory response lagged behind
After the Bybit incident, market panic intensified, but institutional funds quickly flowed in with $4 billion, demonstrating the industrys resilience.
Although regulatory agencies (such as the FBI in the United States) did not intervene immediately, they have begun investigations and called on global exchanges to assist in freezing the hacker funds.
The mature regulatory frameworks in the European Union, Singapore and other places may prompt the industry to strengthen security standards, and the United States may accelerate anti-money laundering and KYC regulatory legislation.
3. Investors should adopt anti-fragility strategies and enhance their own security awareness
Choose a compliant and transparent platform, and pay attention to factors such as team background, reserve proof, and past security record.
Diversify investments and risk management to reduce overall losses caused by single point failures, and combine multiple storage methods such as centralized exchanges, DeFi protocols, and hardware wallets.
Optimize personal security operations, adopt multi-signature, hot and cold wallet isolation, permission management and other measures to reduce the risk of human operation.
Look for opportunities in crises, and rationally allocate assets in the process of accelerated industry safety standardization and institutionalization to avoid short-term losses and seize long-term benefits.
4. Industry Trends: The Crypto Market is Entering the Institutional Era
Although market sentiment is low in the short term, strengthened supervision, innovation in security technology, and accelerated compliance will drive the market towards maturity.
Investors with anti-fragile thinking will gain the upper hand in turbulence, draw on the concept of antifragility, and adjust their strategies to adapt to market changes.
From cold wallets to hot crises: The loss of giants caused shocks, how can investors resist fragility?
Less than two days after the theft of more than $1.4 billion from Bybit, the Hong Kong-based financial payment platform Infini was once again stolen nearly $50 million. For a while, in the turbulent market, investors emotions were once again shrouded in pessimism. Although there have been many thefts in history, such a series of huge thefts have cast a shadow on the already fragile market. The thinking triggered by this is: how should investors view the successive thefts in the industry, and how should they actively adjust their strategies, and still dare to move forward with optimism when the industry is pessimistic.
1. From Bybit to Infini: The Illusion of Security Behind the Breach of Defense
Regarding the Bybit theft, which is the largest single theft in history, there have been many analyses from different angles and dimensions in the market (4 Alpha has also followed up on the incident as soon as possible). However, when the industry has not yet completely calmed down the panic about this matter, Infini was stolen again for nearly 50 million US dollars.
Although Infini, like Bybit, announced full compensation at the first time, all this has not reduced the markets concerns. People cant help but reflect on why the security defenses of industry giants can still be breached under the precedent of multiple thefts in history. If further analysis is found, the occurrence of these thefts involves not only loopholes in the security system of the project/exchange itself, but also involves a series of issues such as the supervision of the blockchain industry and the construction of unified security standards.
1. The main attack process and causes of the bybit incident
Regarding the theft of Bybit, multiple industry security organizations have confirmed that the hackers are mainly from the notorious North Korean hacker group Lazarus Group. According to the latest investigation results on February 26, the group hacked into a machine of a Safe developer through social engineering or other means, and gained access to the front-end infrastructure, and used it to deploy malicious code, deceive the three signers of Bybit, achieve precise strikes, and successfully steal more than $1.4 billion in Ethereum assets from the Bybit cold wallet (Safe team product). It has been basically clear that the theft of Infini was caused by the malicious use of the system permissions of internal engineers, and the hackers method was almost the same as the Bybit incident.
Figure: Bybit exchange attack process
Graphics: Produced by 4 Alpha Group
In the Bybit incident, although the Safe team gave an investigation and explanation report as soon as possible, most industry professionals, including former Binance CEO CZ, were dissatisfied with the Safe security team’s statement, especially the lack of a detailed report on the specific intrusion method. From the perspective of the attack entry, the Safe team, as the wallet provider, should bear the main responsibility. There are deficiencies in its development process and infrastructure security. However, whether similar incidents are solely the responsibility of the wallet provider requires further discussion and thinking.
2. The cold wallet was stolen, highlighting that the industry’s security consensus has not yet been unified
Whether it is the theft of Bybit or Infini, it is a warning to the entire industry: first, we should not over-rely on the illusion of security brought by technology, as any technology can be hacked; second, ignoring the human security line will have fatal consequences.
Cold wallets have long been regarded as the ultimate safe for crypto assets, but the Bybit incident broke this illusion. The cold wallet itself was not directly hacked, but was bypassed through front-end manipulation, which exposed the vulnerability of relying on a single technical solution. The deeper problem is that the industry lacks unified security standards and consensus. Whether it is an exchange or a project party, they often build a protection system based on their own understanding rather than following common best practices. For example, Bybit did not set up a secondary review mechanism for cold wallet operations, and Safe did not strictly isolate development permissions. These human negligence provided hackers with opportunities.
In addition, asset custody, insurance mechanisms and security audits have not yet formed systematic norms in the industry. Historically, multiple thefts from Mt.Gox to Binance have shown that despite technological advances, the ability to systematically combat hackers has improved to a limited extent. The reason for this is that the fragmentation of the regulatory environment has made it difficult to unify investor protection and security standards, and the security levels of various platforms vary. Under this situation, huge amounts of assets are concentrated in a few protocols or platforms, which have become the primary target of hackers.
2. Industry response after the theft: from panic spread to industry self-healing, inspiration from all kinds of people
After the massive theft of Bybit, the CEO immediately live-broadcasted the situation publicly and did not suspend withdrawals. 12 hours after the peak of withdrawals, the entire system returned to normal. However, during this process, the industry experienced huge fluctuations, and market participants and industry regulators responded.
1. Industry self-help and resilience
After the Bybit incident, multiple industry organizations lent a hand to help the exchange overcome the difficulties, with a net inflow of more than US$4 billion within 12 hours, reflecting the continued improvement in the maturity of the industrys crisis response, especially within four hours of the incident. (such as Elliptic and Chainalysis) confirmed that the attack originated from the Lazarus Group within 4 hours and assisted in tracking the flow of funds.
What needs attention is that the user-side reaction is polarized. Although Bybit promised full compensation, the withdrawal volume still surged. On-chain data showed that the transfer volume of stablecoins rose rapidly, and a large amount of funds flowed into the DeFi protocol. This shows that even for the top three exchanges in the industry, users still tend to vote with their feet in the face of huge hacking incidents, giving priority to self-protection rather than trusting the platforms promises. The market panic greed index fell to an extreme panic level in a single day, highlighting the difficulty of restoring confidence.
After the Infini incident, the industry reacted in a similar way. Although the scale was relatively small, the successive attacks exacerbated the markets anxiety. Project owners and security companies began to call for strengthening authority management and third-party audits, and some institutions even proposed the establishment of an industry mutual aid fund to deal with similar crises. The real situation of these industries shows that the user trust of the entire industry is relatively fragile, which further highlights the urgency of accelerating regulatory compliance.
2. The regulator did not intervene immediately, but it may have an impact on the regulatory attitude
Behind these two incidents, we can see more actions of the industry. Although regulators around the world did not speak out immediately, this does not mean that there is no impact on regulation. Just this Thursday, the US FBI has intervened in the investigation of the Bybit theft and called on exchanges around the world to help freeze the assets of the North Korean hacker group.
In the EU and Singapore, there are relatively mature regulatory systems, and this incident may further strengthen the enforcement of regulatory compliance frameworks. For the United States, we expect that this incident may make regulatory authorities further think about the requirements for anti-money laundering and related KYC for crypto platforms. Although President Trump has promised to build a crypto capital, from the SECs previous regulatory stance, technological neutrality and investor protection are important bases and principles for supervision, which may, to a certain extent, accelerate regulatory legislation and speed up the process of building the industrys entire security standardization.
From users voting with their feet on security to the lag in regulatory voice, it is revealed that the entire crypto industry is still in a state of security disorder. However, with the advancement of global regulatory legislation and the acceleration of compliance, it is inevitable that the crypto industry will become more mature and move towards the mainstream. This means that for investors, in the current industry, investment risks and asset security should never be ignored.
3. How investors adjust: Anti-fragility reconstruction, security and compliance remain the top priority
As a responsible asset management institution, in the face of the huge hacking incidents of Bybit and Infini, we always believe that security and compliance are not only the first guarantee for the operation of the institution, but also the highest priority for protecting customer assets. These incidents not only sounded the alarm for the industry, but also provided investors with an opportunity to re-examine their strategies.
In a turbulent market environment, we recommend that investors shift from passive panic to active anti-fragility and deal with uncertainty with a more resilient mindset. The following are our specific suggestions based on years of experience and professional insights:
1. Choose a compliant and transparent platform, but pay more attention to the teams professionalism and industry reputation
When choosing an investment platform, compliance and transparency are basic thresholds, but this is far from enough to cope with the increasingly complex risk environment. We recommend that investors deeply evaluate the platforms team professionalism and industry reputation, which are often key indicators of its long-term reliability. A team with a rich financial background, technical expertise and crisis response capabilities can demonstrate greater resilience and responsibility at critical moments. For example, as an asset management institution, when we screen strategic partners, we will conduct a comprehensive examination of their platforms, including but not limited to proof of reserves, audit reports, past crisis response situations, etc., to ensure that every asset entrusted by the client can stand the test of time. Investors can also refer to this standard and choose platforms that demonstrate responsibility in crises and remain transparent in compliance.
2. Improve self-security awareness, disperse risks, and reduce overall losses caused by single point failures
Technical vulnerabilities and human negligence are the core lessons of this hacking incident, which reminds investors that they must take the initiative to improve their security awareness rather than rely entirely on platform promises. Although cold wallets are not omnipotent, they are still an effective tool for personal asset protection. Combined with regular checks on permission settings and avoiding links from unknown sources, they can significantly reduce the risk of being attacked. At the same time, diversified investment is an effective strategy to resist single point failures. We recommend that investors allocate assets to multiple platforms (such as centralized exchanges, DeFi protocols, and hardware wallets) and configure them across regions and asset classes.
3. Strictly comply with safety operation requirements and continuously optimize safety protection measures
Security is not only a technical issue, but also a reflection of process and discipline. As an asset management institution, we strictly implement multi-signature, hot and cold wallet isolation and hierarchical management of permissions in daily operations, and conduct regular audits to ensure that protection measures keep pace with the times. Investors should also regard security operations as normal. In the face of the continuous evolution of hacker technology, protection measures need to be continuously optimized. We recommend that investors pay attention to industry trends, learn the latest security best practices, and introduce professional custody services or insurance mechanisms when the asset scale is large to further strengthen the defense line. This shift from passive defense to active optimization is a key step in achieving anti-fragility.
4. The industry is rapidly entering the institutional era, looking for opportunities in crises
Although market sentiment is depressed in the short term due to hacking incidents and external macro factors, we believe that crises are often catalysts for industry self-repair and upgrading. Strengthened supervision, innovation in security technology, and the popularization of decentralized solutions will bring long-term benefits to compliant platforms and projects. Investors can take advantage of market panic to carefully plan asset allocation and look for investments with the greatest match of stability and returns.
Our investment strategy has always been centered around this principle. Through multi-strategy asset management solutions, we help our clients capture excess returns amid turbulence, while taking safety and compliance as the bottom line to ensure that every profit can withstand the test of risk.
Drawing on Nassim Talebs antifragility concept, we also encourage investors to view crises as opportunities to optimize strategies rather than mere threats. For example, when the market is extremely panicked, they can build positions in high-quality assets at low levels, or choose relatively robust quantitative arbitrage strategies. Such proactive adaptability can not only help investors avoid losses in the short term, but also enable them to take the lead when the industry recovers.
