I just came up with a new security model that could prevent incidents like another exchange breach, so I’m jotting this down as a note. For now, I’ll validate the idea with AI, and if it seems solid, I may consult with a few people.

BTCPay Server Security Advisory

Binance has begun gradually resuming withdrawals; I assume they have determined that, internally, security is assured and that assets are no longer at risk of being stolen by further attacks. However, no details about the attack, its cause, or current security measures have been announced.

Binance's Security Incident Update #3 has been released, but it primarily discusses refunds and similar matters, with no details on how the attack occurred.

If funds are stolen from an exchange, is it enough that users are fully reimbursed? The money stolen from Binance could potentially fund North Korea’s missiles. That’s why this $1 trillion (approximately $63 billion) theft matters even to people who own not a single yen of cryptocurrency. The U.S. FBI has definitively attributed this incident to North Korea. Governments of Japan, the U.S., and South Korea have long warned that cryptocurrency thefts are a funding source for North Korea’s nuclear and missile programs. Even if Binance fully compensates its users, their assets are protected—but the money for compensation comes from Binance itself. The funds stolen by North Korea remain untouched. According to Binance’s announcement, only about half of the stolen amount had been frozen as of October 30. Meanwhile, the FBI has already confirmed that the perpetrators converted the stolen assets into Ethereum (ETH) and has urged exchanges to halt related transactions. We must track not only how much was compensated to users, but also how much was intercepted before North Korea could use it—and how much was actually recovered. For Japan, this is a matter of national security.

Does Binance implement something like Fireblocks’ policy engine? Currently, it seems like they don’t, but there’s no concrete evidence.

Google's custody service Personally, I'm thrilled—it's an incredible tailwind

A vulnerability (RUSTSEC-2026-0387) leading to timing attacks (side-channel attacks) has been reported in the Rust cryptographic computation crate crypto-bigint. This is not merely an issue of “just update to fix”—it directly impacts products relying on major Web3/EVM stacks such as Alloy, so we are sharing this to clarify the situation and raise awareness. 1. Vulnerability Overview Target crate: crypto-bigint (a fixed-size arithmetic library for large integers) Issue: Internal operations such as subtraction and Montgomery multiplication may introduce conditional branches due to compiler optimizations, resulting in input-dependent variations in execution time. Risk: Attackers could precisely measure execution times at millisecond or microsecond resolution to infer or reconstruct sensitive data such as private keys (timing attack). 2. Why Can’t We Immediately Upgrade? Although a patched version (v0.7.6) of crypto-bigint has been released, upstream dependency constraints are preventing adoption. The widely used EVM/Ethereum library Alloy depends on the cryptographic crate k256 v0.13. However, k256 v0.13 currently does not yet support or has not yet released an update to adopt crypto-bigint v0.7.6. As a result, simply running `cargo update` will not resolve the issue—the dependency lock retains the older version due to this upstream dependency chain. 3. Next Steps & Verification Checklist Visualize Impact: First, run `cargo tree -i crypto-bigint` or `cargo audit` to identify which dependency paths (e.g., alloy -> k256) are pulling in the vulnerable version. Monitor Upstream Updates: Keep track of pull requests or releases from k256 and Alloy to upgrade their crypto-bigint dependency. Consider Workarounds: If immediate action is required, evaluate using `[patch.crates-io]` in Cargo.toml to forcibly override dependencies and test the fix. There will likely be a delay before the fix propagates across the entire Rust/Web3 ecosystem. If you are operating any affected stack, we strongly recommend monitoring your dependency tree closely. ▼ RustSec Advisory: https://t.co/FJSYIOHwtH #Rust #RustLang #Web3 #Alloy #Ethereum #Security #Cryptography

Many people probably ask AI about blockchain-related topics, and here’s my current impression: - Its breadth of knowledge is impressive. - Its research speed is remarkable. - Compared to outputs I’ve received from people I’ve previously hired, it seems to possess graduate-level intelligence. - It makes for an excellent discussion partner. That said, - It doesn’t have professional-level expertise. - It naturally lacks industry-specific knowledge not found online. - It doesn’t possess intelligence beyond graduate level. As a result, every time I ask a question, errors or overlooked details arise, so I must always fact-check and correct it. This is my current impression, based on using the latest paid model. It’s possible my prompts or usage style could be suboptimal.

I speculate that politicians may find it difficult to make political decisions that are unfavorable to other politicians, but if more people start doing this, it might lead to reform.