On Oct. 31, hackers hijacked the domain flap.sh, one of the largest platforms for token launches. A day earlier, Binance reported a theft of approximately $6.3 billion, while a week before that, two critical vulnerabilities were disclosed in PHP, posing a threat to a vast number of websites worldwide.
Renat Tukanov, chief technology officer at Freedom Holding Corp., believes the companies responded appropriately to their respective incidents. The reality, he argues, is that no amount of money can guarantee protection against certain types of attackers. What matters is whether a company can withstand an attack without losing its customers.
What happened to Flap
Flap announced on X that its website had been affected by a DNS hijacking incident, redirecting visitors to an unauthorized website. The team urged users not to visit the site, connect their wallets or sign any transactions.
In simple terms, hackers tampered with the internet’s address book. Users could enter the familiar URL but be redirected to a fraudulent website instead.
The first warning came from a member of the crypto community known as Liquidated, also identified as Dev Arc. He suggested that flap.sh might have been compromised and shared a wallet address allegedly used to drain users’ BNB through a fake wallet-connection page. Another user reported that the site was using a newly issued TLS certificate and that DNS lookup results differed from those returned by Google and Cloudflare resolvers.
Flap’s founder said that only users who visited the compromised website and connected their wallets or signed an authorization during the brief period before the warning were at risk. He stressed that the platform does not store users’ private keys or seed phrases. The total losses have not yet been disclosed.
Flap was not the only platform affected. According to blockchain security firm Blockaid, at least 12 crypto websites, including Kintsu and StonkFun, were targeted in DNS hijacking and frontend attacks on Oct. 31 involving a tool known as StepDrainer.
Meanwhile, at Binance …
The attack came a day after one of the largest cryptocurrency thefts on record. Hackers stole approximately $6.36 billion from Binance wallets across 10 blockchains in about 20 minutes.
Binance’s initial investigation suggested that the attackers may have used a compromised laptop belonging to a DevOps engineer to gain access to a service container and submit unauthorized withdrawal transactions.
Approximately $3 billion has been frozen, more than $2.3 billion of it with the help of stablecoin issuers Tether and Circle. The amount stolen is more than six times Binance’s $1 billion Secure Asset Fund for Users (SAFU). The exchange has pledged to cover all losses and has begun reimbursing affected clients.
A week earlier: PHP vulnerabilities
In late October, another major cybersecurity threat emerged. Kazakhstan’s Computer Emergency Response Team (KZ-CERT) warned website owners about two critical vulnerabilities in PHP, collectively known as PHP2Shell. The flaws allow attackers to execute code remotely without authentication.
Both vulnerabilities received a score of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS). They affect PHP installations serving web requests and could put websites and services built on widely used platforms at risk, including WordPress, Laravel, 1C-Bitrix, Magento, Drupal and Joomla.
As previously reported by Kursiv.meida, the vulnerabilities prompted a response from cybersecurity organizations worldwide, with millions of attempted attacks reported within the first hours of their disclosure. One of the flaws was discovered with the help of an OpenAI model. According to cybersecurity firm Wiz, a single researcher accomplished in one week what would have taken a world-class team months. Artificial intelligence is accelerating the discovery of security vulnerabilities, benefiting both defenders and attackers.
Who is on the other side?
In a July column for Kursiv.media titled «Oh, Brave New Digital World,» Tukanov described cybercrime as a multilevel industry. At the lower end, attackers operate according to economic calculations: they weigh the cost of an operation against its potential returns and look for the cheapest targets. The upper tier operates differently.
«On the upper tier are groups linked to nation-states — such as Lazarus, APT29 and Volt Typhoon. They invest months in preparation, develop their own proprietary tools and select targets strategically. The 2025 attack on Bybit was a prime example: $1.5 billion was siphoned off in a single transaction. The attackers did not even target the exchange itself, but rather its wallet provider, having spent months preparing the operation. In hindsight, everyone knows what should have been done,» he wrote.
He added that no amount of money could guarantee protection against sophisticated attackers. For less sophisticated groups, however, a straightforward principle applies: companies should make themselves more expensive and difficult targets than their competitors.
Notably, Binance has pointed to similarities between the indicators in its case and those associated with previous attacks on Bybit and KelpDAO, which blockchain intelligence firms have linked to North Korean hackers. These are examples of the more sophisticated threat actors Tukanov describes. Against such adversaries, the outcome is determined not simply by whether every door was locked, but by what happens when one is breached.
What Binance and Flap did
Within hours of the Binance incident, the exchange had worked with Tether and Circle, among other industry partners, to freeze approximately $3 billion in assets. Binance pledged to cover the full amount stolen, using SAFU and corporate funds, and began replenishing the affected assets.
Flap, meanwhile, warned users, moved to a new domain and worked to contain the damage. According to the platform’s founder, the risk was limited to users who connected their wallets or signed authorizations during the brief period when the compromised website was active.
For Tukanov, these responses illustrate the kind of resilience by which companies should increasingly be judged.
«The digital world will continue to grow more complex, and incidents will occur more frequently, not less. The winners will not be those who are never hacked — such entities will likely cease to exist. Instead, the winners will be those whose products can withstand an attack without losing customers,» he said.
Why the rules have changed
The PHP2Shell case illustrates the environment in which companies now operate. Two critical vulnerabilities in a widely used programming language were discovered and disclosed, with an OpenAI model reportedly helping a researcher identify one of them. The same tools that accelerate security research can also help attackers find weaknesses.
In a May column for Kursiv.media, Tukanov cited figures suggesting that 45% of AI-generated code fails to pass OWASP Top 10 security checks and that 88% of organizations had experienced confirmed or suspected incidents involving AI agents over the previous year. The volume of code, services and potential entry points is growing faster than organizations can secure them.
«Cybersecurity promises prevention — setting up controls to ensure that nothing bad happens. But in a world with an infinite attack surface, preventing everything is mathematically impossible: a defender must secure every single door, while an attacker only needs one to be open. Cyber resilience starts from the opposite premise: a failure will happen; the question is whether the product can survive it. It’s not about ‘How do we prevent ourselves from being hacked?’ but rather ‘How do we keep operating when it happens?’» he wrote.
To address this challenge, the industry has long embraced the «assume breach» principle, which means operating on the assumption that a system may already have been compromised. The concept is central to Zero Trust architecture, as described by the National Institute of Standards and Technology (NIST) and adopted by major technology companies, including Microsoft and Google.
«We have all already moved into a ‘brave new’ digital world — there are no return tickets — and, all things considered, it’s not bad here: it’s fast, convenient and everything is just a tap away. It’s simply that this world operates under different laws, and the old fences no longer work. For those who have accepted this and adapted, it will remain a ‘brave new’ world. For everyone else, sooner or later, it will reveal why Huxley used that term with such irony,» Tukanov concluded.
The October incidents illustrate the difference between conventional security and cyber resilience. Binance suffered a record-scale theft but has pledged to protect its customers from financial losses. Flap, meanwhile, alerted users and moved to a new domain within hours.
