according to Binance's own account so far, the first statement said it “may involve a compromised DevOps engineer’s laptop” that gave the attacker access to a service container to submit withdrawals. then on Friday, Richard Teng said the attacker “did not simply use one engineer’s permissions”, that they’d found additional points of breach, and malware built to destroy itself and its traces.
replythey also say there’s no evidence any private key leaked yet their own signing system signed the transfers.
Does that mean the laptop was compromised or the DevOps engineer was?
replyThat doesnt mean the key leaked - its likely in an HSM for example, but there is an API to get it to sign stuff. Access to use keys is less bad in many ways than leaking keys, but still pretty useful.
replyNot saying this is the case, but the way this unfolded, and announcement reminded me of the crypto scams that were popular a few years ago (ponzy schemes), with the final rug-pull being "oh no, our platform was hacked, all your funds were lost, sorry!", i.e. "coscoin"[0][1] I know this is not the case here, but the way they announce the hack is funnily similar to how those fake platforms did their final announcement.
replydeleted
replyCrazy thought, but what if they went via the Claude Code trojan?
replyThat is looking more and more like that is was what happened.
replySource?
replyWe could use cyber, crypto and AI in one sentence!
replyProbably a hack, or at least some spearphishing. You can buy a lot of 0days when your budget is billions.
reply