Runnit developer, farmer, AI whisperer, technology professional, politico, recreational athlete
London, Ontario
Joined July 2018
- Tweets27.9K
- Following962
- Followers2.3K
- Likes61.8K
Matt Millar retweeted
Binance published the postmortem on its $6.34 billion hack.
It started in June.
An engineer searched for an AI coding tool.
Downloaded a tampered Homebrew installer.
Binance caught it. Replaced the laptop. Rotated the credentials.
But the attackers had already learned who worked on the wallet team.
September.
A second engineer gets approached on a real job platform.
By someone posing as a project director.
Live video interview with "HR".
Then a take-home assignment.
Downloaded onto a work laptop.
The assignment swapped pyenv for a malicious copy.
Binance's security tools didn't flag it.
October 20.
The attacker used that machine and Binance's own internal AI tool to reach two more wallet engineers.
One had a container deployment token sitting on his laptop.
October 29.
Container deployed. Signing service reached.
Funds started leaving at 20:05 UTC.
Binance suspended withdrawals.
The money kept leaving.
The attacker had already authorized his own contract on the hot wallet, on-chain.
Halting withdrawals didn't touch it.
Revoking it was harder.
The wallet uses MPC.
No single private key exists to sign the revoke.
So Binance had to design a revoke procedure while the funds were still moving.
The last stolen ETH left almost four hours after the first transfer.
The security model designed so no one person could steal the keys.
Also meant no one person could stop it.
Binance says it recovered about 2.85 billion.
And put aside enough to cover the rest.
The FBI says North Korea did it.
Five months of recruiting, interviewing and waiting.
The most expensive take-home assignment ever submitted.
Binance just published how $6.34 billion walked out the door.
June: an engineer searches for a popular AI coding tool, clicks a search result, and installs a tampered homebrew. Binance catches it, replaces the laptop, rotates the credentials. the attackers now know who works on the wallet team.
September: another engineer gets a job offer on a real job-hunting site. first-round interview with “HR” over live video. “HR” shares their social media, personal photos and videos included, so he trusts them. second round is with the “CEO” of a company that doesn’t exist. at the end of the call he’s asked to download a take-home “assignment” onto his work laptop.
the assignment quietly swaps out pyenv for a malicious copy. No antivirus flags it.
october 20: the attacker uses binance’s own internal AI tool to get into two more engineers’ machines. One of them has a container deployment token sitting on his laptop.
october 29: container deployed. Signing service reached. $6.34 billion moved.
Binance shut off withdrawals. the money kept moving anyway, because the attacker had already given their own smart contract permission over a hot wallet, on-chain. binance’s off switch didn’t reach that far.
then they tried to revoke the permission. the wallet uses MPC, so there’s no single private key to sign the revoke with. they had to build a revoke procedure on the spot while funds were still leaving.
last stolen ETH went through at 23:56 UTC. almost four hours after the first transfer.
Phew!
A disappointing result for Londoners looking for change.
Josh Morgan has been re-elected as mayor, and 10 of the 11 sitting councillors who ran again won another term. Four new councillors join them.
Thank you to the 1,063 people who trusted me with their vote. And I'm especially grateful for anyone who put up a sign, made a donation, offered advice, or wrote in with a hard question. You made this campaign better.
Kudos to all of the candidates who sacrificed to give voters an option, and a special shout-out to Luke Thomas here in Ward 9 for running a relentless ground game and finishing a close second, trailing by just 687 votes.
Sadly, across London, despite a 5.5-point increase, only 31% of eligible voters cast a ballot. Once again, those who sat out could have decided the election, by a large margin. Ward 9 came in higher than the average, at about 37%, so I hope that reflects positively on both the candidates and the voters here.
Of the people who voted for mayor, 54.6% chose someone other than the incumbent.
In Ward 9, 60.4% voted for change.
Spending carefully is what I promised to do at City Hall, so I held my campaign to the same standard. From an efficiency standpoint, campaign spending came in at under $2 per vote.
Property taxes, how City Hall spends our money, and the decisions council makes will continue to have just as much effect on us, so I'll keep paying attention, and I hope you will too.
1
5
134
Six votes to pass it. Ten to stop it.
Since July 1, 2023, London’s mayor has held what the province calls strong mayor powers. On certain matters, a by-law can pass with six of council’s fifteen votes, and it takes ten to overrule a mayor’s veto.
The mayor can also write the budget, raise property taxes mid-year, hire the City Manager and run the committees. Today the powers apply to two provincial priorities, both about housing. The Act doesn’t define “provincial priority” or cap how many there can be, and cabinet can change the list by regulation.
A mayor acting in bad faith needs five councillors to go along. A council that agrees on what London needs only has to hold ten together. That’s why the councillors you elect on Monday matter as much as the mayor.
Polls are open Monday, October 26, 10 a.m. to 8 p.m. I’m asking for your vote as a Ward 9 councillor whose vote stays with Ward 9, whoever sits in the mayor’s chair.
The full explainer, with graphics: ward9.online/articles/strong…
1
2
71
October 26th is election day, and I want you to know exactly what you’re getting when you mark Matt Millar on your ballot.
So I’ve put all of my answers on the record, in one place, on ward9.online/ask-matt
More than 20 organizations have sent me their questionnaires, from the Chamber of Commerce to the Labour Council, and fellow Ward 9 residents have sent me their own questions and concerns. That’s over 240 answers, and every one of them is fully searchable. Type in any word, like taxes, traffic, farmland or council pay, and everything I’ve said about it comes up.
Still have questions? Send it to me from that page and I’ll answer it right away for everyone to see. And I’ll keep doing that for the next four years.
As your councillor, I’m going to demand straight answers from City Hall, so I’m offering mine first.
The best vote is an informed vote, and that’s exactly what your vote for Matt Millar on Monday October 26 will be!
London is planning a training campus for police officers and firefighters on a 129-acre property at 3243 Manning Drive, in the south end of the city. Picture a burn tower where firefighters train on live fire, indoor and outdoor firing ranges, and a drill hall, with a driving track and a fire safety village planned for later. The City’s capital budget and plan carry $186.8 million for it through 2033, and the City’s business case pays for the new spending by borrowing against your property tax bill.
A journalist preparing a feature on the campus sent every mayoral and ward candidate the same six questions about how those numbers fit together and who ends up paying.
My short version: our police officers and firefighters need somewhere to train close to home, and it saves time and money over travelling to train in other cities, so I support building the core training facilities. The later pieces should wait until council sees what each one costs and how the City’s published phase figures line up with its budget. If provincial money falls short, I won’t support filling the gap with new borrowing or a tax increase.
1
72
ACORN London sent every candidate a survey on tenant protections. It asked about rental licensing, a landlord registry, inspections, vacant downtown buildings, and housing quality.
Right now, a homeowner renting out a basement apartment needs a City licence and an inspection before the first tenant moves in, while the apartment tower down the street doesn’t need a rental licence at all. My answers start from that gap. I’d point the City’s enforcement at the large buildings that keep generating complaints, and keep new red tape off the homeowner who rents out part of a house to help pay the mortgage.
Here is every question and every answer I submitted, word for word.
ward9.online/articles/acorn-…
2
47
If you come to me with a request, I probably won’t give you the answer you’re looking for.
But here’s why: Every request I get becomes a research project.
First, I dig into the history: Has council dealt with this before? What did they decide, and why? Next, I figure out what a councillor can actually do about it, and I check it against my principles and campaign pledges.
Then I put together a plan that could truly become reality. Or if it's out of council's control, I'll let you know who IS responsible and how to reach them.
A farmer on Woodhull Road was concerned about farmland and urban growth.
Someone off Savoy asked for another set of traffic lights on Wharncliffe.
I could have just agreed and promised them whatever they wanted. But that wouldn't be honest. So I crafted solutions we could work towards together.
More than a dozen Ward 9 residents have written in so far, and every answer is posted on the Concerns page at ward9.online/concerns. I want you to send me yours, too.
You can count on me for an honest answer we can act on. That’s what we should all be able to expect from elected representatives.
1
1
184
Accessibile London Coalition posted their candidate questionnaire results. See how the answers stack up.
accessiblelondoncoalition.ca…
40
At the Ward 9 debate, we got an audience question asking why so many decisions are made at City Hall WITHOUT the final say, or even input, being given by elected representatives. "What will you do to fight the bullies at City Hall?"
I didn't articulate my full thoughts on this given the time constraints. One of my biggest concerns is that we constantly see our councillors deferring to city staff, instead of our elected representatives directing staff. Councillors are elected by the people; city staff is not.
I am not afraid to stand up to the bullies. I will not go along with something I don't believe is right, just because it's the path of least resistance.
Even if I am standing alone, and the outcome is already decided, I will still stand up for Ward 9!
1
3
89
At the Ward 9 debate, we got an audience question asking us if we would oppose any corporation (ie: FLOCK) trying to install ALPRs in London.
My Position: London Police Service already operates mobile ALPR on about 50 cruisers, with a completed privacy impact assessment and a stated policy of deleting non-hit (no matches to any known criminals) data immediately. An officer is behind the wheel deciding where and when to drive, and, most importantly, non-hit data is deleted and not stored in a database. I can live with that system on the condition that the stated policy is actually followed and independently verified, not simply assumed.
A fixed camera network is different. It runs continuously with no officer making a judgment call, and it builds a permanent, searchable record of where every vehicle in the city has been. Waterloo activated exactly this kind of fixed CCTV and ALPR network in June, with more communities expected to follow. I oppose it for London.
My objection is not only corporations, but government as well. I do not trust ANY ENTITY to compile mass surveillance data on citizens, whether the customer is a government or anyone else. A fixed network built and hosted by anyone is unacceptable. A permanent, always-on database creates its own risk regardless of who holds it or how careful today's policy looks: it invites expansion, becomes a target for a breach, and creates pressure to widen its use over time.
1
84
At the Ward 9 debate, a Byron resident asked us why the city allows unsuitable high-density developments that displace single-family homes in neighbourhoods that don't have the necessary infrastructure to accommodate them, and whether we would accept donations from developers.
My answer might surprise you.
1
47
I'm committed to changing the political landscape in Ward 9, and all across London!
Check out ward9.online to see how I'm doing things differently.
Vote Matt Millar for Ward 9 Councillor on October 26!
And if you want to see my answers to all of the questions that WEREN'T asked at the debate, I've got you covered.
teapawt.org/MMward9/status/2100761…
What You Didn't Hear at the Ward 9 Debate
@ULLdn sent every #Ward9 candidate the same 37 questions ahead of Thursday night's debate at Byron Library. The room only got live answers to 5 of them.
I researched and prepared an answer for all 37 anyway.
ward9.online/articles/what-y…
1
13
The London Municipal Election 2026 Ward 9 Debate is now available on YouTube.
If you weren't able to attend live, here's your chance to hear from all of the city council candidates for Ward 9.
youtube.com/watch?v=i-lE6css…
My own responses are in a more easily accessible form on my website
ward9.online/articles/pillar…
13
Pillar Nonprofit Network put their municipal election questionnaire results up on their website.
Take a look and compare the answers from the 4 Ward 9 candidates who responded.
pillarnonprofit.ca/news/you-…
1
65