Binance discloses attack path: replenishing assets is not enough; access controls must also be reviewed
Asset replenishment and system security are two separate issues; proof of reserves cannot replace an independent review of the attack path. Users should still confirm withdrawals by coin and network; development teams should isolate unfamiliar interview code from work credentials.
On November 3, Binance published its preliminary investigation into the October 29 incident: in September, an engineer ran a fake recruitment assignment on a work computer; on October 20, attackers used an internal AI tool to gain further control of other engineers’ devices and obtain deployment credentials; on October 29, they reached the wallet-signing stage. Cointelegraph reported the same attack path that day, but the technical details still come from Binance’s investigation, not an independent media audit.
My understanding is that the key issue is not just who downloaded the malicious code, but that the intrusion spread from an employee’s computer to deployment and signing permissions. The report also says that suspending withdrawals does not automatically revoke existing on-chain authorizations. This shows that closing the usual withdrawal channel does not mean all transfer capabilities have been cut off.
It is also worth noting the remediation progress: Binance says it has rebuilt the affected wallet systems and internal AI tools, and overhauled access controls, while disabling the relevant credentials. However, this is still a preliminary report, the investigation is ongoing, and independent review results are still pending. The remediation statement should not be presented as proof that the security review has been passed.
The replenishment ratio of about 95% cited yesterday came from an earlier announcement; the new report puts it at 98% as of October 31. This updates the disclosed figure; it does not mean the difference was replenished today. The recovery announcement still emphasizes that withdrawals for different coins will not reopen at the same time.
Over the next 48 hours, check for proofs covering newly added coins and the status of withdrawals; after that, monitor whether the independent review covers access-control isolation, credential revocation, and the handling of on-chain authorizations. If these measures are verified and withdrawals continue to operate normally, lower the risk assessment; if there are further unauthorized transfers or the review finds an unclosed attack path, raise it.
#币安 #资产安全 #DeveloperSecurity
Asset replenishment and system security are two separate issues; proof of reserves cannot replace an independent review of the attack path. Users should still confirm withdrawals by coin and network; development teams should isolate unfamiliar interview code from work credentials.
On November 3, Binance published its preliminary investigation into the October 29 incident: in September, an engineer ran a fake recruitment assignment on a work computer; on October 20, attackers used an internal AI tool to gain further control of other engineers’ devices and obtain deployment credentials; on October 29, they reached the wallet-signing stage. Cointelegraph reported the same attack path that day, but the technical details still come from Binance’s investigation, not an independent media audit.
My understanding is that the key issue is not just who downloaded the malicious code, but that the intrusion spread from an employee’s computer to deployment and signing permissions. The report also says that suspending withdrawals does not automatically revoke existing on-chain authorizations. This shows that closing the usual withdrawal channel does not mean all transfer capabilities have been cut off.
It is also worth noting the remediation progress: Binance says it has rebuilt the affected wallet systems and internal AI tools, and overhauled access controls, while disabling the relevant credentials. However, this is still a preliminary report, the investigation is ongoing, and independent review results are still pending. The remediation statement should not be presented as proof that the security review has been passed.
The replenishment ratio of about 95% cited yesterday came from an earlier announcement; the new report puts it at 98% as of October 31. This updates the disclosed figure; it does not mean the difference was replenished today. The recovery announcement still emphasizes that withdrawals for different coins will not reopen at the same time.
Over the next 48 hours, check for proofs covering newly added coins and the status of withdrawals; after that, monitor whether the independent review covers access-control isolation, credential revocation, and the handling of on-chain authorizations. If these measures are verified and withdrawals continue to operate normally, lower the risk assessment; if there are further unauthorized transfers or the review finds an unclosed attack path, raise it.
#币安 #资产安全 #DeveloperSecurity