Tom (@TomKuCoin) header
Tom (@TomKuCoin) profile picture

Tom

@TomKuCoin

Head of Security @kucoincom | Protecting your crypto assets 24/7 Critical threat alerts • Anti-scam education • Exchange security insights

kucoin.com/security
Joined July 2025
  • Tweets107
  • Following10
  • Followers208
20Media
Photo by Tom (@TomKuCoin)Photo by Tom (@TomKuCoin)Photo by Tom (@TomKuCoin)Photo by Tom (@TomKuCoin)Photo by Tom (@TomKuCoin)Photo by Tom (@TomKuCoin)Photo by Tom (@TomKuCoin)Photo by Tom (@TomKuCoin)Photo by Tom (@TomKuCoin)Photo by Tom (@TomKuCoin)
AI has made attacks cheaper, not smarter. What once took a person-day may now cost a few dollars and minutes of model calls. Even a 90% failure rate is acceptable when attempts are cheap. Attack frequency becomes a baseline, not an occasional spike. #staysecurity
6
12
#6 This is more reliable than adding detection rules, as it relies less on attacker traces. Test critical paths monthly with red teams or AI agents. Measure actual TTC, not just whether tests pass. Attack frequency is the adversary's variable. Response time is ours to control.
7
#5 Don't just shorten containment time—extend attack completion time with least privilege, network isolation, separate approvals, secondary checks, and tiered key controls. The goal isn't to stop every intrusion, but to prevent a single compromise from causing irreversible harm.
4
#4 Break TTC down: signal → ticket → assessment → authorization → enforcement. The bottleneck is often approval and execution, not detection. Who can stop a service, block an account, or rotate a key? Make routine actions executable through playbooks; drill the kill switch.
4
#3 The key constraint: Detection delay + containment time < attack completion time (from first foothold to irreversible impact). Faster response alone isn't enough if detection lags or approvals are slow. Each critical path needs its own baseline, not one global SLA.
3
#2 What can be engineered is Time to Contain (TTC): from the first observable signal, not detection, until the critical attack path is cut off and verified. Rotating credentials, revoking access, isolating hosts—containment counts only when controls take effect.
2
#1 A 99% block rate sounds reassuring. But with 100,000 attempts a day, 1,000 still get through—and an attacker may need only one success. Block rate measures defenders' workload, not attackers' cost. It's better used as a diagnostic metric than a scorecard.
4
A secure wallet still depends on a secure device. 🛡️ Malware and compromised devices can expose sensitive data and put crypto assets at risk. 🔍 Keep your OS updated 🚫 Avoid unknown apps and links 🔐 Protect recovery phrases and private keys #StaySecure #Web3Security
Image from Tom (@TomKuCoin)
23
Trust in crypto is about what goes right and how we respond to vulnerabilities. I’m glad our KuCoin team proactively addressed the PHP security vulnerability. User funds and accounts were unaffected. Security remains an ongoing commitment as we keep strengthening our defenses.
KuCoin (@kucoincom) profile pictureKuCoin
@kucoincomOct 22
At KuCoin, building trust starts with protecting our users. Following disclosure of a PHP security vulnerability, our security team implemented safeguards and completed the necessary remediation. User funds and accounts were not affected. We continue to monitor developments and strengthen our defenses to keep our users and platform secure.
1
73
NorForge's Oct 19 disclosure of an AI agent-driven intrusion campaign is only the news hook. What security teams should really discuss are two changes it reveals: the economics of attacks have shifted, and so has the defensive window.
11
23
#11 Three key questions: Can anomalies be detected independently? Can attacks be stopped before webshell deployment? Can breaches be contained to a single site, tenant, or credential? Trusted entry points can also become attack paths. #StaySecure
1
#10 If defenders also run agents, they need kill switches, task budgets, tool-call audits, and approvals for high-risk actions. The same control discipline applies to defensive agents.
1
#9 Four priorities for defenders: 1.Detect attack patterns, not just payloads. 2.Isolate privileges to limit webshell impact. 3.Correlate WAF, host, IAM & model API activity. 4.Prepare and test playbooks for rapid response.
3
#8 Blocking IPs or matching known payloads alone struggles to detect traffic that is syntactically normal but malicious in intent. Trusted entry points can still become attack paths.
2
#7 Another fact: agents did not invent new entry points. Ordinary HTTP requests, browsers, upload endpoints, and model APIs are all trusted entry points. Webshells may be placed deep in hidden directories.
1
#6 More importantly, decisions must move earlier. In the past, teams could manually verify an alert before acting. Now, the time spent verifying it may be enough for the agent to make its next attempt.
1
#5 The defensive window shrinks from days to hours, even minutes. Daily or weekly vulnerability scans, log reviews, and manual analysis cannot keep pace with this cycle.
6
#4 Reuse: successful attack paths can be applied to the next target with a similar technology stack. A 90% failure rate becomes tolerable when failure is this cheap.
1
#3 Cost: ~$5 per task and ~10% success, implying roughly $50 in model costs per successful task. Parallelism: one cluster had 14 panels and 1,100+ projects. Time: under 23 hours on average to achieve an objective.
1
2
#2 The control plane is an attack surface, too. Four changes in attack efficiency stand out: cost, parallelism, time, and reuse.
3
#1 Ironically, attackers used agents to find unauthorized access in others' systems, yet left 25 of their own control panels exposed to the internet. The report attributes this to missing operator-side access controls, not a flaw in Cairn itself.
15
Load more