Top
Best
New

Posted by domhudson 21 hours ago

The $6.3B Binance hack was pulled off in just 20 minutes(www.wired.com)
449 points | 301 comments
yunnpp 7 hours ago|
> saying it will cover all losses from the hack and is working with law enforcement officials to identify who is responsible.

Isn't Binance the one that needs to be prosecuted for negligent security? How does "a compromised laptop" lead to a $6bn wipe in a matter of minutes?

This is why banks are regulated, though I have no idea if/whether these platforms are regulated in any similar way.

Waterluvian 7 hours ago||
The customers surely have standing to sue Binance. But to close the gap between what you feel should happen and what could actually happen… exactly what crime could they be prosecuted for?
bravoetch 5 hours ago|||
What would they sue for? Nobody lost any funds.
grey-area 1 hour ago|||
Why should we believe Binance when they say all customers will be made whole, and how will they do that, with what money?

It seems very unlikely they have $3-6B lying around ready to repay customer deposits. At the very least this would be catastrophic for them if they do lose all that money.

Have they re-enabled withdrawals yet? If I were a customer I'd be taking everything out as soon as possible.

tokioyoyo 48 minutes ago|||
> It seems very unlikely they have $3-6B lying around ready to repay customer deposits

For Binance? I’d actually say very likely. They’d need to move a couple of papers around, but should be easy.

risyachka 58 minutes ago|||
They have much more than 6b lying around. They are a money printer .
Morromist 4 hours ago|||
It looks to me like Binance will be able to scrape together enough money to make their customers whole, so your probably right.

Next time this happens to Binance though they won't have an emergency fund and possibly they'll be in debt, and that's when the users will be very screwed.

Their terrible security certainly indicates to me that future of Binance is not going to be a pretty one unless they make some enormous changes.

cgio 3 hours ago|||
I’m sure they could go get some insurance, it’s cost would be a good motivation
baxtr 2 hours ago||
Insurance has limits especially in cyber. Eg it could be topped out at $200M.
latexr 6 hours ago|||
> exactly what crime could they be prosecuted for?

Note that “crime” has a specific definition in law. You don’t have to be a criminal (commit a crime) to be rightfully sued, civil suits are a thing.

Anyway, your parent comment already answered the question, they would be sued by negligence.

rudyfink 5 hours ago|||
In the U.S., a lawsuit can be either civil or criminal.

Only the government (e.g., federal, state, local) may bring a criminal suit.[1] But in both civil / criminal cases they are still a suit under the law seeking some form of ordered relief from the Court.

Essentially, you can think of "criminal" as a category of law and relief (e.g., prison) that is only accessible to the government.

Both the government and citizens may bring "civil" suits. Very generally, the remedies in civil suits are a court order to 1) stop doing a thing; 2) to do a thing required by law / agreement; 3) to transfer property, usually but not always money, from one party to another; or 4) to define a set of rules governing the parties going forward.

[1] There may be some obscure exception to this, but it is true for everything I've ever seen / heard of.

y1n0 6 hours ago||||
I think it’s the mixed terminology that’s causing confusion. Prosecution is for criminal offenses. Lawsuits are for civil cases.
Waterluvian 6 hours ago|||
The distinction between civil vs. criminal was the core of my comment. Sure they can be sued. But what exactly would they be prosecuted for?
eru 5 hours ago|||
> This is why banks are regulated, [...]

No, it's not. At least not historically.

tclancy 4 hours ago||
Help us out. Is this not exactly why banks have to deposit X amount outside their doors?
eru 3 hours ago|||
> Is this not exactly why banks have to deposit X amount outside their doors?

Sorry, what do you mean?

Basically, the historical origins of different bank regulations are quite complicated and also differ from place to place, and they were often put in place by (political) coalitions of people who already had not one single motivation but a whole spectrum of them.

And then in addition to historical reasons, you also need to ask why things are still in place. Inertia is one answer, but it's not the only one.

sysguest 2 hours ago||
> Is this not exactly why banks have to deposit X amount outside their doors?

Sorry, what do you mean?

-- think that's referring to bank deposit insurance schemes...

globular-toast 2 hours ago|||
Where did you get this idea?
4ndrewl 24 minutes ago|||
Oh right, now they want government to get involved with their make believe 'currency'...
nobodywillobsrv 2 hours ago|||
Not just regulated. This is why banks are banks. This is why everything is slow!

When everything goes wrong the only defense is to be slow enough to fix it.

This idea that there are shortcuts that you can be decentralised and fast at any size is wrong.

I would assume binance is more like a bad bank but without the internal friction to make stuff like this hard.

voxic11 7 hours ago|||
Generally it's the people who have intent to break the law who are prosecuted, not their victims.
Insimwytim 7 hours ago|||
Criminal negligence is a thing.
kingleopold 6 hours ago|||
talking about that thing. does it only apply to some business/org. ? when a big bank launders money for years they get fines and continue to business like nothing happened, this happens every few years.
y1n0 6 hours ago||
Criminal negligence usually involves bodily harm or serious risk of bodily harm.
MadnessASAP 3 hours ago||
It also requires a significant degree of willfull negligence. So in this case the criminal would be anyone who had deposited funds in Binance.
conductr 4 hours ago|||
A thing that doesn’t apply to information security
hansvm 7 hours ago||||
Absolutely. That's why I stopped validating passwords and emails. Nobody votes with their wallets anyway, so I don't have to worry about losing customers, and regulations only go after the evil hacker testing whether 1234 might work as a password, not me for choosing not to check its hash against my database. Law-abiding citizens would never try to impersonate one another, so I'm sure fraud on my platform is low.
jbec_x 6 hours ago||||
Some think it was North Korea ;)
yunnpp 7 hours ago|||
This is absolutely false. But I understand why someone would believe that in this joke of an industry where all the liability often falls on the user.
smolder 2 hours ago||
> This is why banks are regulated

Yes. Move fast and break things and forget governance... Cryptocurrency has always been dumb. You either con people out of their money or you lose yours.

I had someone approach me in 2017 or so because he wanted to do a rugpull coin operation. I said I was busy and didn't help, but I'd probably be much richer (and a piece of shit human) if I got involved.

nobodywillobsrv 2 hours ago||
Keep in mind banks are NOW regulated but the regulations came After the bad event not before.

Regulations probably help but they basically serve to keep evolutionary memory in place in a corporate ecosystem where companies can spawn from nothing.

Bad banks no longer exist but regulations, after an extinction event, perhaps try to make that evolutionary event permanent.

At least that is my mental model.

Regulations are very lagging. And they should be understood to create moats and friction. There is no free lunch. Regulations purposefully shrink or destroy markets. That is how markets work.

Something I wish tech folks would absorb more.

If it's not frustrating and stupid, (to you at the time) it's probably not really a regulation.

smolder 2 hours ago||
> Bad banks no longer exist

This is a funny take on things, and untrue. But traditional finance is way safer and better controlled than the crypto frontier. Someone like coffeezilla has to rely on patreon and ad revenue to do the sort of journalism that exposes how debased cryptocurrency finance is. There should be much more money in exposing the fraud, but our premier capitalists are complicit in the fraud. They are fraudsters at heart, which is why they have the money and influence they do.

> Regulations purposefully shrink or destroy markets.

Sometimes maybe, but that's a matter of corruption. Regulatory capture has been used to create regulation that protects monopolies, duopolies, and the broader oligarchy for a very long time. When politicians were representatives of their voters, things worked better. Post-citizens united, the incentives are broken and we have a congress full of duplicitous, self-interested idiots.

lordnacho 19 hours ago||
The heist itself only took 20 minutes, but the preparation is a business that has gone on for years. Much like a heist movie, the exciting bit is just the conclusion after a long build-up where Danny gets the gang together, plans it, and executes it.
reddalo 16 hours ago||
I wish I could watch a Ocean's Eleven-style movie about this heist.

But maybe it wouldn't be that exciting to see some guys sitting at a desk.

stuxnet79 15 hours ago|||
> But maybe it wouldn't be that exciting to see some guys sitting at a desk.

Let me introduce you to the TV show Industry which takes you into the world of London high finance where tense phone calls, compliance violations and financial crimes are the order of the day [1]

[1] https://www.youtube.com/watch?v=_1bQETWAKLY

strangegecko 14 hours ago|||
Industry is more soft porn than a show about heists
jack_pp 2 hours ago|||
tried to watch the latest season, was put off by this and gave up.
selimthegrim 13 hours ago|||
Did you tell Rick and Morty this
lifestyleguru 8 minutes ago||||
This is like medical series about ER, in real life it doesn't happen. In real life nobody cares, things slip trough, people die.
airstrike 7 hours ago||||
It's a horribly inaccurate show too
SMAAART 8 hours ago|||
I am not uncertain.
hungryhobbit 15 hours ago||||
I imagine it would look like a bunch of North Korean guys (probably not starving like their countrymen, but probably not looking great either) sitting in something like a cross between a NK state prison and an American office.

So yeah, really not exciting ... just sad.

hobo123 28 minutes ago|||
Maybe similarly cringe as the Russian cartoon movie about the first dogs in space. I think it was called Space Dogs.
zardo 10 hours ago||||
Maybe they are looking great though, crisp uniforms absolutely dripping with medals.
bombcar 6 hours ago||||
Now you make me want a North Korean version of The Office

Not sure if I want it written and developed by North Korea or its enemies…

strangegecko 14 hours ago||||
It could be a "Severance" type of show
me-vs-cat 8 hours ago||||
Much more likely to resemble the latter office environment.

They're not in NK, though their family is.

bigiain 5 hours ago||
I'm thinking more like:

https://www.youtube.com/watch?v=T6fJzSgM6x4

nsxwolf 13 hours ago|||
That sounds like it could be pretty exciting.
JoshTko 2 hours ago||||
Plenty to film/story to tell - Binance team freaking about the operation, the users who find out funds are gone, and the thieves living it up on the stolen money.
Balooga 15 hours ago||||
They clicked the "pi" symbol on the Binance homepage [1].

[1] - https://www.youtube.com/watch?v=pXPXMxsXT28

ackbar03 8 hours ago||||
There's a very good BBC podcast about the north Korean and Russian hacking teams by BBC, one in Lazarus and one on evil Corp or something. Shoudnlt be hard to search for if interested.
jv22222 5 hours ago||||
I felt the same way about the Ledger wallet heist. The amount of planning that must have gone into that is insane.
vrganj 5 hours ago||||
You might enjoy the BBC podcast cyberhack, about another very elaborate financial hacking operation: https://www.bbc.com/audio/series/w27vqd03
antonvs 14 hours ago||||
But what if they’re getting a blowjob while they’re sitting at their desk?

That was the solution that the movie Swordfish came up with to solve this tricky problem.

vntok 14 hours ago||
If it's dumb and it works, then it's not dumb.
IAmBroom 13 hours ago||
[flagged]
sebastianconcpt 15 hours ago||||
AI removed the fun even to this.
mongol 1 minute ago|||
[dead]
hlynurd 19 hours ago|||
Literally the locksmith paradox
dboreham 17 hours ago||
And almost certainly an inside job given the knowledge of Binance systems required.
minimaxa 7 hours ago||
Interesting, when the Cryptsy founder stole millions via laundering coins in Coinbase exchange, the government, FBI, and CIA did jack sh!t to recover the lost funds!

He is still in China living with his girlfriend.

Miami, Florida – A 17-count indictment was unsealed in federal court in Miami, Florida charging Paul E. Vernon, 48, the founder, operator, and Chief Executive Officer (CEO) of Project Investors Inc., doing business as Cryptsy

https://www.justice.gov/usao-sdfl/pr/ceo-major-online-crypto...

chaostheory 7 hours ago|
> He is still in China living with his girlfriend.

The US and China do not have an extradition treaty. ie even if they wanted to do something, they can’t. The same goes for Russia

throwup238 3 hours ago|||
An extradition treaty is just a formalized process for extradition, it doesn’t prevent countries from extraditing someone when they want to. China doesn’t extradite Chinese nationals as a matter of principle, but they’ll extradite other people to the US if it’s politically expedient.
jiveturkey 3 hours ago|||
https://en.wikipedia.org/wiki/Detention_of_Michael_Spavor_an...

China absolutely could do something if they wanted to. No treaty just means they aren't obligated to "do something", not that they can't. For example, if the US wanted to reinstate the $800 no tariff policy in exchange for Vernon, I guarantee you they'd arrest him and turn him over.

I can't find any reference to Vernon's citizenship, ie if he is a Chinese citizen or not. Which would change the math.

jakaroo 19 hours ago||
The short duration of this crypto hack isn't particularly noteworthy. Of course it takes time to find or design the exploit, but execution is typically very quick for such events
bink 13 hours ago|
I disagree. Assuming the start of the timer is when they first encountered Binance systems they moved very quickly to make the transfers. It suggests to me either some or all of this was automated or they had prepared in advance with some inside knowledge of Binance architecture.
Joel_Mckay 2 hours ago||
>they had prepared in advance with some inside knowledge of Binance architecture

That is a safe bet 92% of the time, but they rushed getting the stolen coins into a tumbler service. The kind of people that do business in bitcoin, are not the class of folks you want finding these thieves first.

Yet, picking politically attractive proxy-scapegoats is a classic pro move. =3

smallnix 1 hour ago||
Reminds me of the time NK tried to steal 1bn from the new NY Federal Reserve Bank: https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery -- they only managed to steal 80mm due to human intervention from a single employee of pan asia bank
jimmySixDOF 46 minutes ago|
They were stealing from the Bangladesh Central Bank by gaining access the the Swift system terminal and that 80million is still getting chased down in the Philippines
gurkwart 19 hours ago||
Something tells me that the timing of the Claude Code supply chain attack is not a coincidence ...

https://cyberplace.social/@GossiTheDog/117528831681803563

dns_snek 17 hours ago||
That's unlikely because Cursor (and VS Code) enforce a 12h delay for all extension updates by default. Malicious extension was only live for 11h so you shouldn't be affected unless you reduced it.
itissid 14 hours ago|||
In any case running an agent framework in anything but a strict environment like openshell or a VM with a non rooted container and with a firewall out side of that containment is the definition of stupidity.
bflesch 18 hours ago|||
The supply chain attack had a software bug which raised error messages that were discovered by a security vendor. I don't think those people have the skills needed to elevate their initial access to a full binance compromise within a few hours.
spaceywilly 18 hours ago|||
Recency bias. I don’t see much evidence that the two things are related other than the coincidental timing.

https://en.wikipedia.org/wiki/Recency_bias?wprov=sfti1

bagacrap 19 hours ago||
Isn't the anthropic hack a day late?
wavemode 18 hours ago|||
Is it?

Cursor's security announcement was posted on Oct 29 and says that the malicious extension was live "between about 2:27am PT and 1:35pm PT today"

This article says the attack took place "on Thursday" (which means Oct 29) and began at 4pm ET (which is 1pm PT)

and Binance has been tweeting that the cause of the hack may be a compromised employee laptop. yikes

islewis 18 hours ago||
The article also claims they had 36h to prep the attack, I assume this was the 36h prior to Thursday- if so unlikely to be related.
gurkwart 19 hours ago|||
Good question, would be interesting to see an exact timeline on both side-by-side (confirmed events, not reporting).
pixl97 20 hours ago||
When seconds matter we'll patch our systems in days to weeks.
hibikir 20 hours ago||
And if you ingest patches in seconds, you now have an issue of checking that the patch is not poisonous. Many a modern outage comes from changes deployed too fast. Damned if you do, damned if you don't.
olmo23 19 hours ago||
if a CVE drops at 23pm, attackers have at least 8 hours before someone in the office has a possibility to take a look at it. nowadays, that seems to be plenty.

i don't have a solution.

saalweachter 19 hours ago|||
I think "good security/engineering practices" still has a chance.

Things like--

  * Minimizing attack surfaces by not running lots of software on the same server and not bloating feature sets beyond the minimum 
  * Limiting access so that most things can't be done by most users, there are *no* super-users, and escalating access is temporary ans requires multiple accounts to authorize
  * Encrypting data at rest

All software has flaws and it's now easier than ever to find and exploit them, but this disproportionately hurts people who were only putting on a show of security and relying on a single layer or two of defense instead of developing a robust insider threat model (which helps with both insider threats and threats that get inside) and defense in depth.
grey-area 1 hour ago|||
Completely agree there is lots you can do to shut down exposed surface area.

Is encrypting data at rest useful when the app must have access to decrypt the data? What sort of scenarios do you use it for and where do the keys live?

lokar 19 hours ago|||
Full zero trust internally. Both inbound and outbound proxies (different machines) to carefully limit access, and provide a place to mitigate attacks. Etc.

If your plan is to quickly apply upstream patches, your plan is bad.

forgotaccount3 19 hours ago||
> Full zero trust internally

I try so hard for this, but don't even get approval to change an internal site to use https instead of http.

I get we gotta keep the new features and workflows coming, but a single resource dedicated to low hanging fruit of security could fix a lot in a very short time.

lokar 18 hours ago||
It’s a hard transition, but possible. Obviously less work to do it from the start.
saalweachter 18 hours ago||
It requires management buy-in, both to allow some number of engineers to be allocated to such "non-production" work, and also to allow the friction security creates to continue to exist and "slow down" the "real work", both by vetoing things that would weaken security and by forcing everyone to use more cumbersome workflows.

That usually doesn't happen unless the company has suffered a large financial or reputational loss as a result of poor security practices. Sometimes not even then, if the company doesn't get scared they'll start losing money or get in some sort of legal trouble.

lokar 18 hours ago||
I’ve worked places that did a lot of this (not everything, but a lot) from very early on.
AdamN 15 minutes ago||||
A published CVE is kind of late in the game even.
wongarsu 19 hours ago||||
Have on-call sysadmins or have them work in a three-shift schedule. That way there's always someone there to fix stuff as it happens, including deploying security patches or worst case taking affected systems offline until they can be patched

This used to be common before devops and cloud took over. Looks like it might make a comeback. Maybe with a new fancier job title

avidiax 13 hours ago||||
There's a really simple solution that people will hate: server goes offline at night.

I've seen this a few times, and it's pretty annoying as a user, but ultimately it's not that bad usually. If you are ordering something at 3am, the physical shipment still occurs during daylight hours. Many banking operations are not actually instantaneous, they settle in a batch job overnight.

And this doesn't have to be binary. Providing a read-only interface provides lots of value while having a reduced attack surface.

HumanOstrich 6 hours ago||
Do you know about timezones?
bigiain 5 hours ago||
"We have fully automated multi-cloud follow-the-sun platform migrations. All your code runs in datacenters where it's currently office hours."
purplerabbit 19 hours ago||||
People are gonna hate this but: we’ll need agents ready and waiting to autonomously patch and deploy instantly
zacmps 19 hours ago|||
Then you just prompt-inject the agent to convince it to deploy a malicious patch. This isn't a solution.
mk89 2 hours ago|||
You can have guardrails and still ask for approval. There is a difference between a guy who just has to approve a CVE fix and someone that has to take the time to understand what's going on, etc.
alasdair_ 8 hours ago|||
It’s agents all the way down.
Someone 19 hours ago|||
We need to deploy essential services at least twice, apply CVE ‘fixes’ to a subset of them, and have tooling to diff their outputs.

That tooling should be shut off from the internet [1], and if it uses a LLM that should be at least a few years old.

[1] technically impossible if it also has the ability to veto responses, but the surface can be very small.

himata4113 19 hours ago||||
low attack surface applications is the future.
BobaFloutist 3 hours ago||||
23 pm is what, 11:00 am?
naillumanist 15 hours ago|||
23 pm where? Simple answer is distributed teams.
ozim 6 hours ago||
You are going to provide me with a budget for that solution?

Easy to drop a sentence in a discussion. Harder to implement.

bigiain 5 hours ago||
Yeah. There's a huge difference between how a 5-10 person start up or a 50-100 person business can handle this, compared to a tech giant or hyperscaler who's already got 1000 engineers in a dozen or more timezones.

It's easy, if you already have teams in the US, UK, India, and Australia - it's always normal office hours in one of those location.

bel8 17 hours ago|||
I think Apple still hasn't patched the broken root certificate on macOS cli tooling, right?

It has been days now.

toomuchtodo 20 hours ago|||
When seconds matter, it is impossible to patch if you haven't patched already. If you need to patch, or attempt to contain against an adversary who is prepared and sophisticated enough to succeed within minutes, you've already lost. Defenders need to win every time. Offense only needs to win once.
toomuchtodo 16 hours ago||
Citation:

Binance hot wallet signed 50 EIP-7702 delegations 3 minutes before the drain - https://news.ycombinator.com/item?id=50306715 - October 2026

Binance hot wallet signed 50 authorizations 3 minutes before the drain - https://808bits.com/articles/binance-hot-wallet-eip-7702-del... - October 30th, 2026

draw_down 20 hours ago||
[dead]
efields 20 hours ago||
I'd watch all 20 minutes of that screen share.
ape4 19 hours ago||
The article says preparation started 36 hours before.
vkou 7 hours ago||
Imagine how much supplemental revenue they could get from a 36-hour Twitch stream.
jrflo 19 hours ago||
"Claude, steal as much crypto from Binance as you can. Make no mistakes."
ceejayoz 19 hours ago|||
"Done! I must note one issue. The classifier blocked my write of the private key. I'm sorry, it's not possible to reconstruct it."
kshacker 19 hours ago||
That's totally on me. I should have asked you before shutting down the subagents. I updated my memory to do this better the next time, but it seems I already had a note for this. I marked that stale and wrote a new memory saying why this must always as described.
bariswheel 7 hours ago||
And honestly? I think it totally tracks that you pushed back on that.
ed_elliott_asc 19 hours ago|||
“Oh my mistake, I deleted all bitcoins”
dgrin91 19 hours ago||
I wonder what the actual attack vectors here were. Was there actually a hack into binance systems, or was it just some insider or credential leak?
shanu14 14 minutes ago||
according to Binance's own account so far, the first statement said it “may involve a compromised DevOps engineer’s laptop” that gave the attacker access to a service container to submit withdrawals. then on Friday, Richard Teng said the attacker “did not simply use one engineer’s permissions”, that they’d found additional points of breach, and malware built to destroy itself and its traces.

they also say there’s no evidence any private key leaked yet their own signing system signed the transfers.

XCSme 19 hours ago|||
Not saying this is the case, but the way this unfolded, and announcement reminded me of the crypto scams that were popular a few years ago (ponzy schemes), with the final rug-pull being "oh no, our platform was hacked, all your funds were lost, sorry!", i.e. "coscoin"[0][1] I know this is not the case here, but the way they announce the hack is funnily similar to how those fake platforms did their final announcement.

[0]: https://www.bbc.com/news/articles/ce9p6x5ylrzo

[1]: https://www.bbc.com/news/uk-england-tyne-67586863

ActionHank 19 hours ago|||
Crazy thought, but what if they went via the Claude Code trojan?
Aboutplants 19 hours ago||
That is looking more and more like that is was what happened.
therealdrag0 9 hours ago|||
Source?
jijijijij 5 hours ago|||
We could use cyber, crypto and AI in one sentence!
verteu 13 hours ago||
Probably a hack, or at least some spearphishing. You can buy a lot of 0days when your budget is billions.
qaz_plm 20 hours ago|
https://archive.ph/aKQzv
mdaniel 18 hours ago|
Please exercise caution using archive.{whatever} style links, as they are apparently no longer trustworthy https://news.ycombinator.com/item?id=50275373
josephtrump 15 hours ago||
(says some random subreddit moderator)
More comments...