Binance Heist
The massive $6.3 billion cyber heist suffered by crypto exchange Binance last week may have taken place in only about twenty minutes — but the attacks were months in the making.
That’s according an initial assessment released by Binance on Tuesday about how it suffered the world’s biggest-ever cyber heist by hackers the FBI has identified as being a North Korean state-sponsored unit.
At least $5.5 billion of these were liquid assets. Tether announced they had frozen at least $1.567 billion of the stolen USDT, and Circle has frozen around $800 million of stolen USDC. World Liberty Financial froze the $27 million in USD1 stolen by the attacker, and the Arbitrum ethereum layer-2 network froze an additional $30.5 million that had moved to its network. The attacker is estimated to have made off with between $2.4 billion and $3.4 billion.
Binance founder Changpeng Zhao, who is legally not allowed to have any active role with the company [I98] yet still has remarkable amounts of inside knowledge into its inner workings, posted on Twitter less than an hour after the theft that “User funds are safe!”, adding early estimates of how much Tether and Circle had frozen.
[…]
Binance keeps an emergency insurance fund in case of exploits or other crypto disasters. Its most recent balance report puts it at around $1.3 billion. Unless more is recovered, Binance will either fail to make users whole or dip into its own balance sheet — potentially to the tune of 10 figures.
In September, another software engineer was contacted via a “legitimate job-hunting platform” by someone purporting to be a project director who arranged a series of job interviews for the Binance engineer with the fake company. During the first round - a live video interview with the engineer and a fake HR rep - the interviewer “shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust,” according to the report. “This was more advanced and deceptive than previously seen social engineering approaches.”
The second interview with someone purporting to be the CEO of the phony company was conducted on a “popular social chat app,” and toward the end, the CEO instructed the engineer to download an “assignment” containing a malware-laced code repository. The code executed on his work computer during the setup process, which kicked off a series of unauthorized activities.
According to Binance, the malware replaced a legitimate development tool component with a malicious version, which executed commands and established communication with an attacker-controlled external server. The attackers also took steps to hide the malicious script and evade detection, and it worked. Binance’s endpoint security tools did not immediately detect the malware.
A lot of people are focusing on how irresponsible the engineer was about using the work computer. That’s obviously an issue but the bigger failure mode to me is the Engineer C’s container deployment token.
That’s a huge red-flag. In a company of this size, the deployments should be via CI only. CI isn’t just to increase the speed and reliability of deployments but also to provide a clean room to build the software! Even if it’s a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.
