Arif KALEM

You can throw almost everything you know about cybersecurity away now. You need to remember one thing only: Assume any and all technology products and services are unsecured and unsafe. I recently spent a full day resetting passwords and creating new wallets after my personal computer was compromised through a legitimate software application. It had a built-in Chrome browser running with the application's administrator privileges, which allowed a payload to be delivered through JavaScript from a compromised website. There wasn't much I could have realistically done differently from a conventional cybersecurity perspective to prevent it. That's the problem. You can now get attacked internally, externally, upstream, downstream, at the application layer, at the infrastructure layer, through social engineering, brute force, supply chain compromise, or simply because a trusted third-party vendor had a vulnerability of its own. And we've had a pretty spectacular run recently: ➡️ Nov 2026: European supermarket refrigeration systems and French blood storage facilities were affected through connected refrigeration infrastructure. ➡️ Nov 2026: Mercado Bitcoin suffered a cyberattack involving roughly $48 million in unauthorized asset movements across multiple chains. ➡️ Oct 2026: PHP2Shell exposed critical use-after-free vulnerabilities in core PHP components that could enable unauthenticated remote code execution. ➡️ Oct 2026: eMudhra disclosed eight cryptographically weak intermediate CA private keys. One of them was literally the number 4. ➡️ Oct 2026: Binance suffered a $6.34 billion security incident involving a multi-stage campaign that included social engineering, endpoint compromise, malicious software, and compromised internal tooling. ➡️ Oct 2026: Cathay Pacific, JAL, ANA and others were affected by unauthorized access to reservation data held by upstream technology provider Amadeus. ➡️ Oct 2026: Ledger users lost around $90 million after genuine hardware wallets sold through a Southeast Asian reseller were physically tampered with using hidden implants. ➡️ Oct 2026: CoinDCX lost $15.99 million after funds accumulated in deprecated wallet infrastructure with known historical vulnerabilities. ➡️ Sep 2026: Bitget suffered unauthorized transfers of approximately $388 million from its hot and warm wallet infrastructure. ➡️ Sep 2026: Liquid Network suffered an approximately $320 million exploit caused by a vulnerability in its transaction validation software. ➡️ Aug 2026: A years-old Coldcard firmware flaw weakened seed generation enough for attackers to reconstruct private keys offline, leading to roughly $116 million in losses. Different companies. Different technologies. Completely different attack vectors. The situation is dire, and there is no single clean solution. Let me put it into something easier to understand. You are a very careful driver. You never break traffic laws, you wear your seat belt, you maintain your car, and you pay attention to the road. Hackers are the reckless drivers around you. You stay alert and try to avoid them. Occasionally, you discover an internal problem, like a faulty airbag. You go through a recall, fix it, and perhaps replace the car. But now there are entirely new dimensions of risk. Imagine your car being compromised because its radio connects to a malicious radio station. Or because the company that manufactured one tiny component was breached. Or because someone discovers that a particular alloy used across millions of cars has a fundamental flaw. You can be the world's most careful driver and still get screwed. That's increasingly what cybersecurity looks like. And AI makes the next phase particularly worrying. Whether or not AI was directly involved in any individual attack, it dramatically lowers the cost of searching enormous amounts of old code, documentation, dependencies, and infrastructure for obscure vulnerabilities. At the same time, we're producing an explosion of hastily built software, AI-generated code, agents, plugins, integrations, and "vibe-coded" products that introduce entirely new places for vulnerabilities to hide. The next 18 to 24 months are going to be brutal. We're only at the beginning of a period where extremely old vulnerabilities will be rediscovered while entirely new ones are being created faster than we can properly audit them. So yes, use strong passwords. Use MFA. Use hardware wallets. Patch your systems. Separate devices. Minimize privileges. Do everything cybersecurity people have been telling you to do for the last 20 years. But don't mistake any of those things for being "safe". The new mindset is ASSUME COMPROMISE. Assume your computer can be compromised. Assume your browser can be compromised. Assume your wallet software can have a bug. Assume your hardware can be tampered with. Assume your vendor can be breached. Assume your vendor's vendor can be breached. Build your security around limiting what happens when something fails, not around believing nothing will. And ah yes, of course, don't forget the oldest attack vector of them all: You may still have an old-fashioned spy around you trying to obtain sensitive information.

My thoughts are with the @Bitget team and everyone affected by the recent wallet incident. Having worked in this industry, I know how difficult it is to deal with a security incident like this. If there’s any way we can help, we’re ready to support. Standing against those who seek to undermine the industry is a responsibility we all share. In moments like this, the industry stands together.