11月11日 - 朝鲜一个精英黑客组织从币安窃取63亿美元，这再次引发外界审视加密货币行业一个长期存在的弱点：黑客可能只需攻破一名员工就能潜入内部，而各平台安全措施参差不齐，使他们能够利用这一立足点实施大规模盗窃。
Nov 11 - An elite North Korean hacking group’s $6.3 billion theft from Binance is renewing scrutiny of a longstanding weakness in the cryptocurrency industry: hackers may need to compromise only one employee to get inside, while inconsistent security practices can allow them to turn that foothold into a massive theft.
据币安的初步调查，这起10月29日的盗窃案被专家称为史上最大规模的加密货币盗窃案，经过数月策划和准备后，在短短几分钟内完成。
The October 29 heist, described by experts as the largest cryptocurrency theft ever, unfolded in a matter of minutes after months of planning and preparation, according to Binance’s initial investigation.
网络安全专家表示，这起攻击不仅让人质疑交易所如何保护员工免受复杂社会工程攻击，也让人质疑交易所是否具备足够的内部控制，以限制攻击者在某名员工的电脑或凭证被攻破后能够做什么。
Cybersecurity experts said the attack raises questions not only about how exchanges defend employees against sophisticated social engineering, but also about whether they have adequate internal controls to limit what an attacker can do once an employee’s computer or credentials are compromised.
标普全球旗下区块链安全提供商OpenZeppelin的首席技术官乔纳森·亚历山大表示，社会工程攻击是业内已充分理解的威胁。他说，更大的问题在于，为什么交易所没有更强的内部防护和熔断机制，来阻止攻破工程师电脑的攻击者——就像币安发生的情况那样——提升权限并转移资产。
Social engineering is a well-understood threat in the industry, said Jonathan Alexander, chief technology officer of S&P Global’s OpenZeppelin, a blockchain security provider. The bigger question, he said, is why exchanges do not have stronger internal safeguards and circuit breakers to prevent an attacker who breaches an engineer’s computer — like what happened at Binance — from escalating access and moving assets.
亚历山大表示，行业内网络安全做法各不相同，这加剧了问题；此外，一些加密货币倡导者长期反感他们眼中的管控措施，认为这些措施与区块链的去中心化理念不符，有时将交易金额限制和支出模式自动审查等做法视为侵犯固有的隐私权。
Varying cybersecurity practices across the industry compound the problem, Alexander said, along with a longstanding aversion among some cryptocurrency advocates to controls they view as inconsistent with blockchain’s decentralized ethos that sometimes views things such as limits on transaction amounts and automatic reviews of patterns of spending as infringing on inherent privacy rights.
亚历山大说：“我认为，这种错误说法让一些人以为，像熔断机制、对账户施加更多控制这样的措施是不可接受的，或者会与避免审查的需要完全冲突。”“在我看来，你既可以有安全控制，也可以有防范审查的保护措施。”据区块链情报公司Chainalysis称，币安此次遭攻击是一系列重大加密货币黑客事件中的最新一起，自2021年以来，这些事件已导致超过223亿美元资金被盗。损失的规模加剧了一场争论：交易所是否需要更一致的标准来规范访问、交易控制和其他防御措施。
"I think that falsely, that has led some people to think that things like circuit breakers, things like more controls on the accounts, would be unacceptable or would be absolutely in conflict with that need to avoid censorship," Alexander said. "In my view, you can have security controls and have protections against that." The Binance attack is the latest in a string of major cryptocurrency hacks that have resulted in more than $22.3 billion in stolen funds since 2021, according to blockchain intelligence firm Chainalysis. The scale of the losses has intensified debate over whether exchanges need more consistent standards governing access, transaction controls and other defenses.
亚历山大说：“我确实预计，我们会在网络安全预期方面看到更明确、更标准化的做法，并有望看到对投资者保护和信任的要求。”“这些事情说明了为什么必须改变。”高度显眼、极具吸引力的目标加密货币交易所是格外有吸引力的目标，因为黑客可以找出持有巨额可随时转移数字资产的 wallets，在某些情况下还能找出有权访问控制这些系统的员工。
“I do expect we’ll see more clarity and standardization in the kind of cybersecurity expectations and, hopefully, requirements for investor protection and trust," Alexander said. “These things show why it has to change." HIGHLY VISIBLE, ATTRACTIVE TARGETS Cryptocurrency exchanges present unusually attractive targets because hackers can identify wallets holding enormous sums of readily transferable digital assets and, in some cases, the employees with access to the systems controlling them.
这使工程师和IT人员成为精心策划的社会工程行动的主要目标。区块链和数字资产安全公司Project Eleven首席执行官亚历克斯·普鲁登表示，防御者面对只需成功一次的攻击者，处于根本性的劣势。
That has made engineers and IT workers prime targets for elaborate social-engineering operations. Alex Pruden, CEO of blockchain and digital-asset security firm Project Eleven, said defenders face a fundamental disadvantage against attackers who need to succeed only once.
“这是一个极其棘手的问题，”普鲁登说。“我们迄今为止所拥有的网络安全最佳实践，根本无法应对我们所处世界面临的威胁。”
“This is an extremely hard problem,” Pruden said. “The best practices in cybersecurity that we’ve had up to this point are just simply not up to the task of the world that we live in in terms of what the threat is.”
他还说，业内的网络安全工作者“生活在一个持续作战的世界里。我们不断遭受攻击。”普鲁登预计，币安失窃事件将推动网络安全领域加大投资，包括围绕内部人工智能工具和代理程序设置防护措施，因为这些工具一旦被攻破，本身就可能扩大攻击者的能力。
Cybersecurity workers in the industry, he added, “live in a world of constant warfare. We are under constant attack.”Pruden expects the Binance theft to spur greater investment in cybersecurity, including safeguards around internal AI tools and agents that could themselves expand an attacker’s capabilities if compromised.
“我们正处于这个故事的开端之初，但我认为，正如币安黑客事件所表明的那样，这些工具可能非常、非常迅速地被反过来用来对付你，而且一旦造成损害，就很难挽回。”据路透社10月30日报道，币安黑客事件后，加密货币交易所已开始着手加强防御并增加信息共享。
"We’re at the beginning of the beginning of that story, but I just think like the Binance hack showed, those tools can be turned against you very, very quickly and they can be very hard to undo the damage once it’s done." Cryptocurrency exchanges have already begun moving to bolster defenses and increase information sharing following the Binance hack, Reuters reported October 30.
监管拼凑、防御不均 专家指出的安全实践参差不齐，也反映在美国碎片化的监管体系上。
PATCHWORK OVERSIGHT, UNEVEN DEFENSES The uneven security practices identified by experts are mirrored by a fragmented US regulatory system.
与银行不同，美国加密货币交易所并不在单一的联邦网络安全制度下运营。相反，要求因公司运营地点和所持州牌照而异。
Unlike banks, US cryptocurrency exchanges do not operate under a single federal cybersecurity regime. Instead, requirements vary depending on where companies operate and which state licenses they hold.
纽约州实施了业内一些最严格的要求。该州金融服务部要求持牌公司维持网络安全项目、使用多因素认证，并指定一名首席信息安全官。
New York imposes some of the industry’s toughest requirements. The state’s Department of Financial Services requires licensed companies to maintain cybersecurity programs, use multi-factor authentication and designate a chief information security officer.
在其他地方，加密公司可能主要受州汇款机构规则约束。这类制度通常要求公司向监管机构提供其网络安全项目的信息并接受检查，但往往不规定具体的技术控制措施，例如加密标准。
Elsewhere, crypto companies may be subject primarily to state money-transmitter rules. Those regimes generally require companies to provide regulators with information about their cybersecurity programs and undergo examinations, but often do not prescribe particular technical controls, such as encryption standards.
许多交易所并不在美国运营，也不受这些州级监管制度的约束，尽管它们可能在开展业务的任何地方遵循另行规定的要求。
Many exchanges do not operate in the US and are not subject to those state oversight regimes, although they may operate under separate requirements wherever they do business.
相比之下，银行则受联邦要求的约束，涵盖风险评估、监控和事件响应等领域，而最大的机构还要接受专职监管人员的持续检查。
Banks, by contrast, are subject to federal requirements covering areas including risk assessments, monitoring and incident response, while the largest institutions undergo continuing examinations by dedicated supervisors.
7.2万只股票。这个月你错过了哪些赢家？你阅读申报文件。你核对数字。你形成判断。一个人可以认真地对少数几家公司做到这一点。
72,000 stocks. Which winners did you miss this month? You read the filings. You check the numbers. You form a view. One person can do that properly for a handful of companies.
ProPicks AI 则在全球7.2万只股票上完成这项工作，每月更新股票名单，涵盖多种多样的方法，从中小盘股，到能源和医疗板块，再到以股息为重点的策略等等。
ProPicks AI does it across 72,000 of them globally, with newly updated stock lists every month that cover a diverse range of approaches, from small and mid-caps, to energy and health sectors, to dividend-focused and beyond.
每一只入选股票都基于100多项财务指标筛选，并附有清晰说明，让你在行动前可以自行核查。
Each pick is selected on 100+ financial metrics, with a clearly explained so you can check it before you act.
三年多来，我们的旗舰策略“科技巨头”的回报率是标普500指数回报率的2.3倍。现限时享受55%折扣。
Over three years, our flagship Tech Titans strategy has returned 2.3X the S&P 500's returns. Now 55% off for a limited time.