I wonder what the actual attack vectors here were. Was there actually a hack into binance systems, or was it just some insider or credential leak?
I wonder what the actual attack vectors here were. Was there actually a hack into binance systems, or was it just some insider or credential leak?
according to Binance's own account so far, the first statement said it “may involve a compromised DevOps engineer’s laptop” that gave the attacker access to a service container to submit withdrawals. then on Friday, Richard Teng said the attacker “did not simply use one engineer’s permissions”, that they’d found additional points of breach, and malware built to destroy itself and its traces.
they also say there’s no evidence any private key leaked yet their own signing system signed the transfers.
Does that mean the laptop was compromised or the DevOps engineer was?
That doesnt mean the key leaked - its likely in an HSM for example, but there is an API to get it to sign stuff. Access to use keys is less bad in many ways than leaking keys, but still pretty useful.
Not saying this is the case, but the way this unfolded, and announcement reminded me of the crypto scams that were popular a few years ago (ponzy schemes), with the final rug-pull being "oh no, our platform was hacked, all your funds were lost, sorry!", i.e. "coscoin"[0][1] I know this is not the case here, but the way they announce the hack is funnily similar to how those fake platforms did their final announcement.
[0]: https://www.bbc.com/news/articles/ce9p6x5ylrzo
[1]: https://www.bbc.com/news/uk-england-tyne-67586863
Crazy thought, but what if they went via the Claude Code trojan?
That is looking more and more like that is was what happened.
Source?
We could use cyber, crypto and AI in one sentence!
Probably a hack, or at least some spearphishing. You can buy a lot of 0days when your budget is billions.