The most costly vulnerabilities aren’t in smart contracts—they’re on engineers’ computers.
Binance has made public how the October 29 theft happened: In June, a wallet engineer clicked a Google search ad and installed a tampered version of Homebrew; in September, a “recruiter” arranged a video interview, and the coding test contained a backdoor. In the end, hackers used stolen credentials and an internal AI tool to drain funds from a hot wallet in 20 minutes. The FBI attributed the attack to North Korea’s TraderTraitor.
When a bank gets robbed, nobody says the bank should shut down. Publishing every step of how it happened is better than staying silent like its peers.
No zero-day exploit. No cracked private keys. Just an ad, an interview, and an AI tool with too many permissions.
That same week, it was discovered that NIKKE’s PC launcher had been compromised since late September, stealing browser passwords, cookies, and wallet data. The publisher quietly replaced the files without issuing a single statement.
My rules:
The computer I use for my wallet doesn’t run games or “test projects” sent by strangers.
I install tools from official websites and never click search ads.
The directories AI tools can access don’t contain my seed phrase.
Using two computers—one for gaming and one for managing money—sounds like something only rich people do. It’s actually just cheaper than losing money.
$BNB
Binance has made public how the October 29 theft happened: In June, a wallet engineer clicked a Google search ad and installed a tampered version of Homebrew; in September, a “recruiter” arranged a video interview, and the coding test contained a backdoor. In the end, hackers used stolen credentials and an internal AI tool to drain funds from a hot wallet in 20 minutes. The FBI attributed the attack to North Korea’s TraderTraitor.
When a bank gets robbed, nobody says the bank should shut down. Publishing every step of how it happened is better than staying silent like its peers.
No zero-day exploit. No cracked private keys. Just an ad, an interview, and an AI tool with too many permissions.
That same week, it was discovered that NIKKE’s PC launcher had been compromised since late September, stealing browser passwords, cookies, and wallet data. The publisher quietly replaced the files without issuing a single statement.
My rules:
The computer I use for my wallet doesn’t run games or “test projects” sent by strangers.
I install tools from official websites and never click search ads.
The directories AI tools can access don’t contain my seed phrase.
Using two computers—one for gaming and one for managing money—sounds like something only rich people do. It’s actually just cheaper than losing money.
$BNB