The Binance hack and a lesson in how to manage a catastrophe
A service that can request signatures is as good as the key. What failed in the largest crypto theft on record, and why I give Binance's response 10 out of 10.


Head of Security at Immunefi, crypto security and AI expert · Portugal
A service that can request signatures is as good as the key. What failed in the largest crypto theft on record, and why I give Binance's response 10 out of 10.

Social media and tech apps will do anything to capture your attention. In this silent war for the most valuable resource, willpower isn't the way out.
With the advent of LLM agents, being a 'Specialist' is losing relevance. The Generalist, more flexible and adaptable, gains the advantage in the new business reality.
Traditional security awareness programs have failed to achieve their intended effectiveness. Humans are lazy, and the Security Culture needs to account for that.

“Binance says no key leaked, but its own systems signed the withdrawals, and once software with signing permissions is compromised, it doesn’t really matter if the key itself is secure. [...] That doesn’t mean crypto itself isn’t safe.”

“At the end of the day we will have to wait and see.”

“CX is important for any service provider [...] given the nature of what is at stake: trusting the provider with some of the most sensitive data and access to the customer. So a proper service experience is adamant about building that trust and making the customer not just be secure, but also feel secure. [...] A good provider will help the customer leave the engagement with a more robust company security framework, not just know the details of the incident it suffered.”

“Everything has flaws. What matters is what a flaw gets you, and here it gets you private images of people inside their own home. So the question is not what the manufacturer intends but what the design allows when something goes wrong. [...] The cloud service and the update channel are the two worth worrying about, because compromising either one has the potential to reach every device the company has sold, not only yours.”

“I've taught crypto devs for many years. If you want to go from zero to hero in smart contracts, Mastering Ethereum is the definitive no-fluff guide I recommend above all to achieve that.”
Also quoted inPplware · Tek Notícias · American Banker · The National · crypto.news · Crowdfund Insider · Coinjuice · The Crypto Times · DL News · Help Net Security · ThreeSigma · Tek Sapo · The Block · Solidity Blog · Decrypt · Cointelegraph Magazine · Immunefi - Medium · AstroPublishing
Common S3nse 2026 (Amsterdam)
Common S3nse 2026 (Amsterdam)
DEFCON's Bug Bounty Village
ETHDam 2024
TrustX 2023 (DevConnect Istanbul)
Solidity Summit 2023 (Devconnect)Head of Security at Immunefi, protecting billions in crypto assets across the Web3 ecosystem.
Protecting billions in the on-chain economy.
Building AI-powered security agents.
Interested in Web3 security, AI, or potential collaboration? Feel free to reach out through any of these channels.
Get notified when I publish new articles.
I use your email only to send new articles, through Resend. You can unsubscribe from any email.