As mentioned in the previous post, devops's machine need to be segregated or air-gapped when doing crucial ops with ip whitelisting, etc. Meanwhile, their machines are supposed to be monitored closely physically during working time and not supposed to be used to access critical cluster off work. Finer-grained access control should be applied and any high-privilege access like cluster access need to be logged and permitted by multi seniors. Probably most of devs are working remotely, but for the critical access must require "multi-approval" via online meeting to ensure security. @cz_binance @heyibinance The attacks are no longer protectable by smart contract audit or typical blockchain security, but requires deep-infra experts at CTO level that understands the entire workflow and knows the bolts and nuts of how the complex system works in happy path/corner cases. It's a huge challenge for SMEs and even big companies like @binance , but it's becoming common practice in post-AGI era. No bullet proof, have to constantly learn and apply patches.