Hackers on October 31 intercepted control of the address flap.sh, one of the largest platforms for launching tokens. A day earlier, Binance reported the theft of $6.3 billion, and a week earlier critical vulnerabilities threatening most of the world's websites were found in PHP. Group CTO of Freedom Holding Corp. Renat Tukanov believes both companies acted correctly. It is just that against some attackers there are no guarantees for any money, and the winner is the one who survives an attack in such a way that the client does not leave. This was reported by Qazaqyia.kz citing Kursiv Media.
Flap said on X that its site suffered a DNS hijacking and traffic was redirected to an unauthorized resource. The team urged users not to visit the site, not to connect wallets and not to sign transactions. Simply put, hackers substituted the internet's 'address book': a user entered the usual address but landed on a fake.
A crypto community member under the nickname Liquidated (Dev Arc) was the first to raise the alarm. He claimed that flap.sh could have been compromised and published an address that, according to him, stole users' BNB through a fake wallet connection page. Another user noted that the site used a newly issued TLS certificate, and DNS query results diverged from Google and Cloudflare resolver data.
The founder of Flap said that only those who visited the substitute site and connected a wallet or signed a permission within a few minutes before the warning was published were at risk. He stressed that the platform does not store users' private keys and seed phrases. The amount of damage has not yet been disclosed.
Flap was not the only victim. According to Blockaid, on October 31 at least 12 crypto sites, including Kintsu and StonkFun, suffered DNS hijacking and frontend attacks linked to the StepDrainer tool.
The attack on Flap occurred the day after the largest hack in the history of the crypto industry. Malefactors withdrew about $6.36 billion from Binance wallets across 10 blockchains in roughly 20 minutes. Initially, the exchange pointed to a compromised laptop of a DevOps engineer, through which the attacker gained access to a service container.
According to Binance, a number of attack signs match previous robberies linked to North Korea, including the Bybit and KelpDAO hacks. About $3 billion was frozen, of which more than $2.3 billion was frozen by stablecoin issuers Tether and Circle. The stolen amount is more than six times the exchange's SAFU insurance fund of $1 billion. Binance promised to cover all losses and began returning money to clients.
At the end of October, a significant part of the internet was under threat. KZ-CERT warned Kazakh website owners about two critical vulnerabilities in PHP under the common name PHP2Shell, which allow remote code execution without authentication. Both received 9.2 points out of 10 on the CVSS scale, and some of the errors have been present in the code since 2012. WordPress, Laravel, 1C-Bitrix, Magento, Drupal, Joomla and other popular platforms are at risk. Earlier, Kursiv reported on the reaction of regulators around the world and millions of hacking attempts in the first hours.
One of the vulnerabilities, which could have existed for about 20 years, was discovered using an OpenAI model. According to Wiz, one researcher did in a week the work that a world-class team would have needed months for. AI accelerates the search for holes for both defenders and attackers.
In a July column for Kursiv, 'O divny tsifrovoy mir' ('Oh, wonderful digital world'), Tukanov described cybercrime as an industry with floors. The lower floor works by economics: it compares the cost of entry with the loot and takes the cheapest target. The upper floor is arranged differently.
'On the upper floor are groups linked to states: Lazarus, APT29, Volt Typhoon. Months of preparation, their own developments, strategic choice of targets. The attack on Bybit in 2025 was exactly like that: one and a half billion dollars left in a single transaction, even though they attacked not the exchange itself but its wallet provider, and prepared the operation for months. In hindsight, everyone knows what should have been done,' he writes. And further: 'Against the upper floor there are no guarantees for any money. Against the lower floor a simple rule works: become more expensive than your neighbor.'
Binance itself points to the coincidence of attack signs with the Bybit and KelpDAO robberies, which are linked to North Korea. This is the upper floor. For such an adversary, the outcome is determined not by whether every door was closed, but by what happens after one of them opens.
Binance, together with Tether and Circle, froze about $3 billion within hours, promised to cover all losses even though the amount is six times the SAFU fund, and began returning money. Flap warned users within minutes, moved to a new domain and limited the damage to those who managed to connect a wallet in the short window. By the logic of the column, this is the result by which companies should now be evaluated.
'The digital world will continue to become more complex, and incidents will happen more often, not less. Winners will not be those who are never hacked. There will most likely be none left. Winners will be those whose product survives an attack in such a way that the client does not leave,' Tukanov believes.
The PHP2Shell story shows the environment in which everyone now operates. A vulnerability that existed for about 20 years was found using an OpenAI model, and one researcher did in a week the work that a world-class team would have needed months for. The same tools are available to attackers. In an April column for Kursiv, Tukanov cited data that 45% of AI-generated code fails security checks under the OWASP Top 10 standard, and 88% of organizations faced confirmed or suspected incidents involving AI agents within a year. Code, services and entry points are growing faster than they can be protected.
'Cybersecurity promises prevention: build controls so that bad things do not happen. But in a world with an infinite attack surface, it is mathematically impossible to prevent everything: the defender needs to close every door, the attacker needs just one. Cyber resilience proceeds from the opposite assumption: when a failure occurs...'