BINANCE REVEALS THE ENTIRE HACK: HACKER SECRETLY INFILTRATED THE COMPANY FOR 5 MONTHS BEFORE STRIKING!
- June 2026: An employee on the Wallet DevOps team downloaded a maliciously modified Homebrew package while searching for AI coding tools. Binance detected the anomaly, replaced the device, and rotated credentials. However, the hacker had already obtained information about the personnel and structure of the wallet development team.
- September: The hacker posed as a recruiter and contacted a software engineer through a legitimate recruitment platform. After several rounds of fake interviews, the victim was asked to download a coding test onto their work computer. The file contained zero-day malware capable of evading endpoint protection tools at the time.
- October 20, 2026: The hacker used a compromised computer and an internal Binance AI tool to reach two more engineers on the Wallet team. The hacker then discovered an employee with a Deployment Permission Token that allowed containers to be deployed on the wallet infrastructure.
- October 29, 2026: The hacker used the stolen access to deploy a malicious container and tamper with the hot wallet transaction-signing system.
#BTC
- June 2026: An employee on the Wallet DevOps team downloaded a maliciously modified Homebrew package while searching for AI coding tools. Binance detected the anomaly, replaced the device, and rotated credentials. However, the hacker had already obtained information about the personnel and structure of the wallet development team.
- September: The hacker posed as a recruiter and contacted a software engineer through a legitimate recruitment platform. After several rounds of fake interviews, the victim was asked to download a coding test onto their work computer. The file contained zero-day malware capable of evading endpoint protection tools at the time.
- October 20, 2026: The hacker used a compromised computer and an internal Binance AI tool to reach two more engineers on the Wallet team. The hacker then discovered an employee with a Deployment Permission Token that allowed containers to be deployed on the wallet infrastructure.
- October 29, 2026: The hacker used the stolen access to deploy a malicious container and tamper with the hot wallet transaction-signing system.
#BTC