GoPlus Security 🚦 (@GoPlusSecurity): In recent years, DPRK hackers have stolen over $6.7B in crypto assets through social engineering and other fraudulent tactics.
Estimated coin impact
Scores are not price-change percentages. High impact means a score of +70 or more, or -70 or less.
In recent years, DPRK hackers have stolen over $6.7B in crypto assets through social engineering and other fraudulent tactics. With the integration of AI, attack methods such as DeepFake and AI-driven vulnerability discovery have become more powerful and stealthier, making them significantly harder to defend against. The Web3 security paradigm urgently needs to evolve — “Zero Trust + AI” may be the right path forward. ⚠️ Key Point 1: Humans remain the weakest and most overlooked link in security operations Even when teams use cold wallet multisigs and protocols hold hundreds of millions in TVL, attackers can still break through via long-term trust building (e.g. months of meetings and deep business interactions). The recent attack on @DriftProtocol is not an isolated case. @tayvano_ has listed dozens of well-known DeFi protocols — including Sushi, Thorchain, Yam, Pickle, Harvest, Reclaim, Harmony, and Beanstalk — all of which have experienced similar social engineering infiltrations. ❗Human trust ≠Security authorization❗ Face-to-face meetings, shared repositories, and feature testing — these “industry norms” have become advanced threat vectors. Stay vigilant. Enforce Zero Trust + cross-verification. ⚠️ Key Point 2: Continuous security monitoring and auditing across contracts, systems, and teams are essential ▪ Team level: Regularly audit access permissions for key roles (multisig / admin addresses / hardware wallets). Implement device isolation, periodic permission rotation, and Zero Trust training. Investigate any anomalies immediately. ▪ System level: Maintain isolated and secure development environments. Disable or monitor known high-risk editor behaviors. Enforce code reviews and software supply chain audits. ▪ Smart contract level: Conduct regular AI-powered audits to continuously identify vulnerabilities. Prevent attackers from leveraging AI to exploit legacy vulnerabilities in contracts. Recommended: GoPlus DeepScan https://deepscan.gopluslabs.io ❗Security today ≠Security forever❗ Attacks and infiltration are ongoing at all times. Security cannot be relaxed — complacency and false confidence often come with severe consequences. 🚨