Polymarket and Binance Hacked in Succession: The Security Farce of the Crypto World

When "Decentralization" Meets "Basic Blunders"

Recently, the crypto prediction market Polymarket and top exchange Binance suffered major security incidents one after another, turning the security narrative of "decentralized finance" into a laughingstock once again. A YouTube tech commentator recapped these two incidents in a mocking tone and also uncovered the "backdoor" scandal of Ledger hardware wallets. For users who rely on crypto platforms to trade or "predict the future," this has undoubtedly been a terrible week; for onlookers, this farce is full of irony.

Polymarket, a well-known crypto prediction platform, allows users to bet on the outcomes of future events, placing it somewhere between gambling and financial derivatives. The entry point of this hack is baffling: attackers tampered with the CDN service (DebugBear) that Polymarket relies on, replacing normal JavaScript scripts with malicious versions, causing funds in the accounts of users visiting the site to be instantly transferred away. The commentator bluntly stated that it is simply unbelievable for a website managing users' sensitive information and funds to load scripts directly from a CDN without version pinning or integrity checks—a "naked" security practice.

After the incident, Polymarket promised to compensate users for their losses, but attached a telling condition: users with losses exceeding $10,000 must sign a contract containing a "non-disparagement clause," prohibiting them from publicly criticizing the platform on social media. The commentator jokingly called this operation "gagging people with contracts," which also exposed the arrogance in the centralized compensation process.

CDN (Content Delivery Network) is a set of edge servers distributed around the world, used to deliver static resources (such as JavaScript, CSS, and images) to users nearby to reduce latency and improve loading speed. Websites usually only need to reference the script URL on the CDN in HTML, and the browser will automatically fetch and execute it from the nearest node. However, this convenience also introduces supply chain risks: if the CDN is compromised or misconfigured, attackers can replace the script content, and all websites referencing that script will execute malicious code without users' awareness. A common defense against such attacks is Subresource Integrity (SRI), which attaches a cryptographic hash of the content to the <script> tag; the browser verifies the hash after loading and refuses to execute if it does not match, thereby ensuring the script has not been tampered with.

Binance's $6 Billion Heist: A Textbook Supply Chain Attack

If Polymarket's vulnerability stemmed from negligence, then Binance's theft is more like a dark comedy. According to the FBI, the attack resulted in approximately $6 billion in assets being stolen, with the mastermind directly linked to North Korea. This figure is almost equivalent to one-fifth of North Korea's annual GDP, showing just how crazily state-level hacker teams covet crypto assets.

Binance's own preliminary investigation revealed the attack path: a wallet DevOps engineer searched "how to install Homebrew" on a personal work computer and clicked on a malicious ad in the search results, causing the system to be implanted with a backdoor. Subsequently, another software engineer was contacted by an attacker posing as a project director on a job platform and downloaded and ran malware during a "interview." Using these two infected computers, the attackers stole a container deployment permission token from a wallet DevOps engineer, deployed malicious containers within a specific time window, and ultimately triggered scripts that stole a huge amount of funds.

It sounds like a spy movie plot, but it actually happened at a company managing billions of dollars in assets. The commentator couldn't help but complain: why does an ordinary engineer's laptop have the permission to move billions of dollars? Why is there no multi-signature approval or manual review mechanism for large transactions? Why can a single script bypass all risk controls? These questions point to the same answer—while pursuing "efficiency" and "trustlessness," the crypto industry often sacrifices the most basic security redundancy of traditional finance.

More ironically, Binance froze about $3 billion in assets during the attack. The commentator pointed out that this directly betrays the core promise of cryptocurrencies to be "censorship-resistant and unfreezable"—when a crisis comes, a centralized exchange can still lock down funds with one click. The so-called "code is law" looks pale and powerless in the face of reality's iron fist.

Container deployment permission tokens are credentials used for identity authentication and authorization in cloud-native environments, typically existing in the form of Kubernetes ServiceAccount Tokens or similar. A process or user holding such a token can call the cluster API to create, modify, or delete containers (Pods), and even mount sensitive volumes or access internal networks. In an ideal security model, such tokens should follow the principle of least privilege: granting only the necessary operation permissions within a specific namespace, setting a short validity period, and using network policies to limit their scope of use. Once a token is stolen, an attacker can disguise themselves as normal operations traffic within a legitimate time window to deploy malicious containers, thereby bypassing traditional perimeter defenses.

Can't Get the Funds Back? Hackers' Money Laundering Creativity

Stealing cryptocurrency is only the first step; how to safely transfer and launder it is the real challenge. Hackers usually use mixers such as Tornado Cash to obscure the flow of funds, but the Binance attackers demonstrated a more sophisticated operation: within minutes before the assets were frozen, they deposited 60 million stolen USDT into the AVA protocol as collateral and borrowed about 19,762 ETH, then quickly transferred the ETH and left. As a result, the collateral on AVA was frozen, while the hackers had already fled with the ETH—a "clean and neat" exit.

The ingenious design of this money laundering path stands in sharp contrast to the sloppiness of Binance's internal risk controls. The commentator joked that this is simply a model play of "future finance": hackers use DeFi protocols to hedge against centralized freezing risks, while victims can only watch their funds disappear.

Mixers (such as Tornado Cash) are decentralized privacy protocols where users deposit cryptocurrency into a pool and then withdraw an equal amount to a different address, thereby severing the direct link between on-chain deposits and withdrawals and obscuring the flow of funds. Mixers were once seen as tools to protect the privacy of legitimate users, but because it is difficult to distinguish the source of funds, they are often used by hackers for money laundering, so regulators in many countries have imposed sanctions on them. Unlike mixers, attackers may also use DeFi lending protocols for "hedged money laundering": using stolen funds as collateral to borrow other assets; if the collateral is frozen, the borrowed assets have already been transferred to a safe address, achieving risk isolation.

Hardware Wallets Are Not Safe Either: Ledger's Supply Chain Poisoning

If you think putting your assets in a hardware wallet means you can rest easy, you are too naive. At the end of the video, the commentator dropped a bombshell: over the past few years, Ledger hardware wallets were intercepted in transit by unknown parties and implanted with additional hardware to record the private keys entered by users. These devices were activated and used by users like ordinary wallets, while the private keys had long been quietly stored. The attackers waited patiently for years and eventually stole about $86 million in one go.

This incident completely shattered the myth that "cold wallets are absolutely safe." The trust chain of a hardware wallet depends not only on the chip and firmware but also on every link in production, packaging, and logistics. When the supply chain is infiltrated, physical isolation becomes useless. The commentator concluded helplessly: in the crypto world, whether on-chain or off-chain, there seems to be nowhere that is truly safe.

Hardware wallets are physical devices that store private keys in offline secure chips; transaction signing is completed inside the device, and the private key never touches a networked environment, theoretically resisting cyber attacks. However, their security depends heavily on supply chain integrity: from chip manufacturing, firmware flashing, device assembly, to packaging and logistics, infiltration at any link may introduce hardware backdoors or firmware tampering. Attackers can intercept packages in transit, implant additional components that record keystrokes or screen data, or replace devices with ones preloaded with malicious firmware. When the user activates it, the private key is secretly captured. Preventing such attacks relies on manufacturers' tamper-evident designs, firmware signature verification, and users initializing devices themselves after receipt and checking official verification information.

The Lack of Security Culture Is the Root Disease

From Polymarket's naked CDN, to Binance's social engineering vulnerabilities and permission failures, to Ledger's logistics hijacking, these incidents share one thing in common: a long-term absence of security culture. The crypto industry champions "rapid iteration" and "code autonomy," yet often ignores the most basic security engineering practices—dependency version pinning, network isolation, the principle of least privilege, review of large transactions, and employee security awareness training.

The commentator half-jokingly suggested: if someone asks you to download and run unknown software during an interview, you might first ask in return, "What do you think of Kim Jong-un's hairstyle?"—although it is a joke, it points out the key to social engineering defense: stay alert to any unusual request. Today, with AI agents within reach, using AI tools to scan suspicious scripts and check file system changes has become a low-cost security habit.

According to the commentator's summary, this series of incidents has not only caused heavy losses for "degenerate gamblers" but also tarnished the reputation of the entire crypto industry once again. When hackers can easily make off with billions of dollars using an ad, a fake interview, or an unverified script, perhaps we should rethink: is the so-called "decentralized" financial future just traditional financial risks repackaged into a more exciting game?

(This article is based on the content of a YouTube tech commentary video; incident details are subject to official disclosures.)