Compliance/Reconciliation| Catholic| Man-U| MBA|Conflict and Peace
Lagos, Nigeria
Joined July 2012
- Tweets43.8K
- Following2K
- Followers2.2K
- Likes4.5K
Lucky Okoro retweeted
Binance just published how $6.34 billion walked out the door.
June: an engineer searches for a popular AI coding tool, clicks a search result, and installs a tampered homebrew. Binance catches it, replaces the laptop, rotates the credentials. the attackers now know who works on the wallet team.
September: another engineer gets a job offer on a real job-hunting site. first-round interview with “HR” over live video. “HR” shares their social media, personal photos and videos included, so he trusts them. second round is with the “CEO” of a company that doesn’t exist. at the end of the call he’s asked to download a take-home “assignment” onto his work laptop.
the assignment quietly swaps out pyenv for a malicious copy. No antivirus flags it.
october 20: the attacker uses binance’s own internal AI tool to get into two more engineers’ machines. One of them has a container deployment token sitting on his laptop.
october 29: container deployed. Signing service reached. $6.34 billion moved.
Binance shut off withdrawals. the money kept moving anyway, because the attacker had already given their own smart contract permission over a hot wallet, on-chain. binance’s off switch didn’t reach that far.
then they tried to revoke the permission. the wallet uses MPC, so there’s no single private key to sign the revoke with. they had to build a revoke procedure on the spot while funds were still leaving.
last stolen ETH went through at 23:56 UTC. almost four hours after the first transfer.
Phew!
Lucky Okoro retweeted
Binance published the postmortem on its $6.34 billion hack.
It started in June.
An engineer searched for an AI coding tool.
Downloaded a tampered Homebrew installer.
Binance caught it. Replaced the laptop. Rotated the credentials.
But the attackers had already learned who worked on the wallet team.
September.
A second engineer gets approached on a real job platform.
By someone posing as a project director.
Live video interview with "HR".
Then a take-home assignment.
Downloaded onto a work laptop.
The assignment swapped pyenv for a malicious copy.
Binance's security tools didn't flag it.
October 20.
The attacker used that machine and Binance's own internal AI tool to reach two more wallet engineers.
One had a container deployment token sitting on his laptop.
October 29.
Container deployed. Signing service reached.
Funds started leaving at 20:05 UTC.
Binance suspended withdrawals.
The money kept leaving.
The attacker had already authorized his own contract on the hot wallet, on-chain.
Halting withdrawals didn't touch it.
Revoking it was harder.
The wallet uses MPC.
No single private key exists to sign the revoke.
So Binance had to design a revoke procedure while the funds were still moving.
The last stolen ETH left almost four hours after the first transfer.
The security model designed so no one person could steal the keys.
Also meant no one person could stop it.
Binance says it recovered about 2.85 billion.
And put aside enough to cover the rest.
The FBI says North Korea did it.
Five months of recruiting, interviewing and waiting.
The most expensive take-home assignment ever submitted.
Binance just published how $6.34 billion walked out the door.
June: an engineer searches for a popular AI coding tool, clicks a search result, and installs a tampered homebrew. Binance catches it, replaces the laptop, rotates the credentials. the attackers now know who works on the wallet team.
September: another engineer gets a job offer on a real job-hunting site. first-round interview with “HR” over live video. “HR” shares their social media, personal photos and videos included, so he trusts them. second round is with the “CEO” of a company that doesn’t exist. at the end of the call he’s asked to download a take-home “assignment” onto his work laptop.
the assignment quietly swaps out pyenv for a malicious copy. No antivirus flags it.
october 20: the attacker uses binance’s own internal AI tool to get into two more engineers’ machines. One of them has a container deployment token sitting on his laptop.
october 29: container deployed. Signing service reached. $6.34 billion moved.
Binance shut off withdrawals. the money kept moving anyway, because the attacker had already given their own smart contract permission over a hot wallet, on-chain. binance’s off switch didn’t reach that far.
then they tried to revoke the permission. the wallet uses MPC, so there’s no single private key to sign the revoke with. they had to build a revoke procedure on the spot while funds were still leaving.
last stolen ETH went through at 23:56 UTC. almost four hours after the first transfer.
Phew!
