WuBlockchain
Binance’s preliminary investigation, mapped by WuBlockchain, traces the attack to a sequence of compromises involving three engineers and the exchange’s internal wallet signing service. Attackers ultimately used credentials stolen from Engineer A to deploy a container and run a malicious script, initiating unauthorized asset transfers on October 29.
Why it matters
The timeline began in June, when Engineer A downloaded a tampered Homebrew installer while setting up an AI coding tool. Binance detected the incident, replaced the device and rotated credentials, but information about the engineer and colleagues had been exposed. In September, Engineer B downloaded a malicious code repository during a fake job interview, compromising his work computer.
Market impact
On October 20, attackers used the compromised device and an internal AI tool to gain control over Engineers A and C, then found a container deployment permission token on A’s computer. Nine days later, they accessed C’s computer and used A’s stolen credentials to deploy the container and execute the script.
The sequence highlights how compromised employee devices, exposed credentials and deployment permissions can combine to reach sensitive signing infrastructure. The investigation timeline is preliminary.
Frequently asked questions
-
How did attackers reach Binance’s internal wallet signing service?
They used credentials stolen from Engineer A to deploy a container on Engineer C’s computer and run a malicious script, which initiated unauthorized asset transfers.
-
What happened after Binance detected the June incident?
Binance replaced Engineer A’s device and rotated credentials, but information about the engineer and colleagues had been exposed.
-
How was Engineer B’s computer compromised?
In September, Engineer B downloaded a malicious code repository during a fake job interview, compromising his work computer.
-
What did attackers find on Engineer A’s computer?
On October 20, attackers discovered a container deployment permission token on Engineer A’s computer.
-
Why did the attack involve three engineers?
The timeline describes compromises involving Engineers A, B and C. Attackers used Engineer B’s compromised device and an internal AI tool to gain control over A and C.
CryptoSlate
CoinDesk
TheBlock
WatcherGuru