山鸡-'s Profile | Binance Square

A simple explanation for everyone of how the $6 billion Binance hack happened:

The overall attack chain went roughly like this: fake recruitment scam tricked an employee into running malicious code → took control of the employee’s computer → used internal AI tools to keep compromising coworkers’ computers → stole deployment credentials → accessed the wallet signing system → transferred assets, while retaining on-chain permissions.

1. The groundwork
In June, an operations engineer, A, downloaded a tampered development tool. Although the company discovered this, replaced the computer, and reset the credentials, the attackers had already gained access to A’s identity and those of related coworkers.

2. A fake interview compromised another employee
The attackers impersonated recruiters and arranged a video interview to build trust. They then asked engineer B to download an “interview assignment” onto their work computer. The assignment contained malware, which ran during installation and gave the attackers control of B’s computer.

3. From one person’s computer to the wallet team
Using B’s computer and internal AI tools, the attackers went on to take control of A’s and C’s computers. On A’s computer, they found credentials that could be used to deploy containers—essentially a pass to put programs into the internal environment.

4. Accessing the signing process and getting the wallet to transfer funds
On October 29, the attackers used C’s computer and A’s credentials to deploy malicious software, gaining unauthorized access to the internal wallet signing service.

5. Leaving behind additional permissions meant suspending withdrawals wasn’t enough
The attackers also used Ethereum’s EIP-7702 to grant their malicious contract permission to operate the wallet. This meant that even after Binance shut down the normal withdrawal channel, the on-chain authorization that was already in effect could still be used, and a separate transaction was needed to revoke it. According to the report, the emergency revocation process for MPC wallets added to the response time.

6. Revoking permissions and freezing assets brought it to a close
Binance removed the malicious authorization and worked with external organizations to freeze and intercept funds. The report says the incident involved around $6.34 billion, of which approximately $2.85 billion was frozen or intercepted. Binance absorbed the losses.

In a nutshell:
After some asshole’s computer was compromised, the attackers made their way to deployment privileges and fund-signing permissions. Shutting down the business channel doesn’t automatically revoke on-chain permissions that have already been granted.

$BNB $BTC $ETH

山鸡-

Trending Topics