How the biggest exchange hack ever actually happened
Binance just released initial findings on the Oct 29 incident. Short version: not one bad click, but a slow, patient attack that started months earlier.
June. A wallet DevOps engineer (Engineer A) downloaded a tampered Homebrew installer for an AI coding tool. Security caught it and replaced the laptop, but the attackers had already mapped A and the wallet team.
September. Engineer B got a fake job offer: an HR video call, then a "CEO" round, then a take-home repo run on a work computer. It carried 0-day malware that endpoint protection missed.
October 20. From B's machine, the attackers used an internal AI tool to reach A and wallet engineer C. On A's machine they found a token with container deployment rights.
October 29. Using C's computer and A's credentials, they deployed a container whose script reached the wallet signing service. Funds left hot wallets from 20:05 UTC.
The twist was EIP-7702: they delegated part of a hot wallet's control to their own contract. That lived on-chain, so pausing withdrawals couldn't stop it, and with MPC there was no single key to revoke. It took until 00:10 UTC Oct 30 to clear.
Now: about $6.34B impacted, roughly $2.85B frozen or intercepted. Binance says it is absorbing the loss and users bear none. The FBI says North Korea is responsible.
Lesson: fake job offers, fake installers and poisoned dev tools are the front door now. Double-check every download and every "interview" task.
h/t CryptoTelugu on X
NFA. Just sharing what the report says.
#Binance #CryptoSecurity #BNB #Hack #EIP7702
Binance just released initial findings on the Oct 29 incident. Short version: not one bad click, but a slow, patient attack that started months earlier.
June. A wallet DevOps engineer (Engineer A) downloaded a tampered Homebrew installer for an AI coding tool. Security caught it and replaced the laptop, but the attackers had already mapped A and the wallet team.
September. Engineer B got a fake job offer: an HR video call, then a "CEO" round, then a take-home repo run on a work computer. It carried 0-day malware that endpoint protection missed.
October 20. From B's machine, the attackers used an internal AI tool to reach A and wallet engineer C. On A's machine they found a token with container deployment rights.
October 29. Using C's computer and A's credentials, they deployed a container whose script reached the wallet signing service. Funds left hot wallets from 20:05 UTC.
The twist was EIP-7702: they delegated part of a hot wallet's control to their own contract. That lived on-chain, so pausing withdrawals couldn't stop it, and with MPC there was no single key to revoke. It took until 00:10 UTC Oct 30 to clear.
Now: about $6.34B impacted, roughly $2.85B frozen or intercepted. Binance says it is absorbing the loss and users bear none. The FBI says North Korea is responsible.
Lesson: fake job offers, fake installers and poisoned dev tools are the front door now. Double-check every download and every "interview" task.
h/t CryptoTelugu on X
NFA. Just sharing what the report says.
#Binance #CryptoSecurity #BNB #Hack #EIP7702
