Binance is the world's largest crypto exchange. Its security came down to a guy searching for an AI coding tool.
That's the story. Co-CEO Richard Teng says the attackers "spent months building their way in." Months. The same patience most people spend on a sourdough starter, except this one paid out $6.34 billion.
Here is the timeline. In June, an engineer on the wallet team downloaded a tampered version of a developer tool. By October 20, the attackers had used his machine and an internal AI tool to reach two more wallet engineers. On October 29, the money left.
Four months. Nobody noticed. The internal AI tool noticed nothing either, and it was reportedly helping the thieves.
Binance calls this a "multistage attack." Fair. The stages were: download, ignore, ignore, ignore, ignore, wire.
The fake job interview deserves its own moment. Someone at the world's largest crypto exchange was so eager for a new gig that he went along with a stranger's coding assignment. He was already employed at Binance. Wallet infrastructure. The crown jewels. And he was out there interviewing.
Now the good news. Binance says it has replenished 98% of the affected assets. Teng says customers will not bear any losses. Wonderful. Somewhere a retail trader who lost $40 on a dog coin is being told by a support bot that his case is "under review."
Binance is also adding AI-enabled detection and a security research fund. It is fixing an AI problem with more AI. That's like treating a dog bite by buying a second dog.
Independent experts will review the incident. They will find the thing everyone already found. A person clicked something.
Billions in custody. Months of access. And the vault key was a bad Homebrew install.
Never ask a crypto exchange to hold your money. It can't even hold its own interview.
Photo by André François McKenzie on Unsplash
Leave a Comment