Again, if your systems are so simple and weak that a single employee's device can move the money, then you are fucked. In fact, if you have a single critical system that can move…

Original source excerpt

Again, if your systems are so simple and weak that a single employee's device can move the money, then you are fucked. In fact, if you have a single critical system that can move all your money, then…

Again, if your systems are so simple and weak that a single employee's device can move the money, then you are fucked. In fact, if you have a single critical system that can move all your money, then you are fucked. Single points of failure will fuck you. Always. I understand that being fucked is totally normal in this space. But I refuse to pretend that it's okay. It's absolutely not. It's honestly this mindset that leads to so many of these hacks. Binance and Bitget are unique in that they actually do have relatively complex systems with a lot of moving pieces. It's actually not as simple as one device -> one box -> all the money (as much as CT is making it seem like it is 🤮) But if we go back to other recent incidents, the "limit access to critical systems and hope no one gets malware" has resulted in, literally, billions stolen. Limiting access doesn't replace EDR. EDR doesn't mean youll detect every single malicious thing (or react in perfect time.) Only doing short lived hardware MFA tokens doesn't mean they magically cant follow you into the systems (or find a backdoor via a different vuln/0day.) And, certainly, assuming your employees wont get phished is never going to cut it when there are billions on the line. You MUST assume that people and devices get popped and limit/eliminate the damage even if that happens.

Collected source wording; claims are attributed to the source and are not independently verified here.