The $6.3B Binance Hack Was Pulled Off in Just 20 Minutes
wired.com113 points by domhudson 3 hours ago
113 points by domhudson 3 hours ago
As a former crypto proponent, after ~17 years I think we have to have a real discussion about the value crypto does or doesn't bring to the world.
Sure, it let's some people keep their savings safe from dictatorial countries. But it also fuels other dictators that are doing pretty nasty stuff to their own people. And crypto is facilitating that.
I think that public/permissionless crypto is going to remain a niche. It's clear that there are too many footguns and failure modes for the average user.
But I think private/permissioned chains will gain some adoption in the background of tradfi, especially for settlement, clearing, collateral management via tokenisation etc.
I am a regular guy but I just never understood the point of Crypto other than for scams and get rich quick schemes. Not to mention it still is tied to the dollar for value which defeats the entire purpose doesn't it ? I thought it was supposed to be an independent currency. And then you have companies like coinbase which are centralizing something that was supposed to be decentralized ? I just don't get it.
At least initially, much of the "point" was to bypass Chinese currency controls. Buy mining hardware and electricity in yuan funny money. Mine cryptocurrency. Sell it for real fiat currency. Buy real estate in Vancouver.
It's not tied to the dollar and yes, the purpose is to have a neutral currency.
The decentralised mode never interested general public, even though it was mildly interesting as an idea to skip hierarchical trust. The established use of crypto is exclusively money laundering and investment scams, made usable for general public though use of centralised exchanges. The crypto isn’t important, it is just an excuse.
Yea I just don't see any real benefit and it has been almost 20 years. This is why I immediately lose respect for anyone who still peddles crypto even though there were some well meaningful people in early days.
My wealth may be decentralized, but my body is in one location and pretty vulnerable to the 5 dollar wrench. Putting some emergency money in a foreign bank account and a bag is a much better option if I wanted to flee a country.
I know what’s going to happen. I will explain what crypto is for and then it will get downvoted just because it says anything positive about crypto.
The point is to NOT have a single place with access to all the money, votes, etc. Every participant should be acting as themselves, and there should be no way to do things on behalf of others without their consent.
The point of smart contracts is to have code you can actually trust. Your bank or openAI can change their website, APIs and even their models tomorrow. That’s not great for trust. Trust is what enables things to scale.
The same way you trust other internet protocols to just “route around problems” and not have one single point of failure, that is the substrate for Web3.
Imagine a Web2 website such as a student-teacher marketplace NOT handling millions of dollars, accepting money from students and paying them out to teachers. Imagine it being simply an interface while the actual transactions are approved by the students themselves, and instead of the central site signing payouts with some keys, the teachers get paid through smart contracts and code on the blockchain. The site can still take 10% commission from everything, it would be above board, and it can never change it without the consent of the people. The business logic is in the smart contract.
(Since this comment has the keywords “crypto” and “web3”, I know what will happen in advance already.)
I think crypto lead in 99% of cases just to bad actors and use-cases, I still have to encounter one real success story of someone using crypto successfully long-term or to pay for legit, legal stuff where a different method was not allowed due to unfair restrictions.
I think one of the primary motivations for cryptocurrency was that legal ≠ moral. Therefore, I think cryptocurency's best use cases are all explicitly illegal.
For example, you can donate to Sci-Hub with cryptocurrency. Sci-Hub has an ideological mission which is widely supported, but it runs afoul of copyright law, and is illegal in nearly every country. You cannot donate to Sci-Hub with fiat currency.
Unfortunately, I agree that in practice >99% of cryptocurrency's use if for scams.
I have read of Venezuelans using it as a safe harbor against their currency instability.
That seems valuable, but I’m not sure how much truth there is to a story I read on the internet.
it's a pretty good tool if you need a ransom payment after you hack a hospital
Let's reframe that; it's very useful for maintaining continuity of care in medicine!
I thought that the whole point of crypto was money laundering and tax evasion. Like, it's in cryptocurrency DNA, even if people try to squint and see legitimate use cases. Does anyone think otherwise?
I mean, that's what the big mean government does, they monitor financial transactions and they collect taxes. But when we talk about financial privacy from the prying eyes of the government as a goal, and let's suppose people actually use crypto like was dreamed, this necessarily implies crypto being a tool to launder money. (in practice, this is better realized by privacy coins like Monero and ZCash, since Bitcoin sucks for privacy: your address is an anonymous handle but the network leak metadata. But, the desire for financial privacy was there in the Bitcoin community since the beginning).
And what else people do when they can hide their money from the government? In a lot of cases, they don't pay taxes (which is also a disposition present in the Bitcoin community since the beginning, with a rhetoric like, collecting taxes are not legitimate)
What I think was a later development was the main use case for crypto in real world, which is to collect payment for ransomware and things like this. This, I don't think it's something the early Bitcoin community envisioned.
I don't disagree, but the way you say that makes my eye twitch uncontrollably. So many of us have spent the better part of those 17 years trying to get the crypto proponents to have a real discussion about it.
> safe from dictatorial countries.
Yeah, that's definitely an argument. But it's kind of funny when the backdrop is that $6B was taken by North Korea.
It feels like a sibling to the popular attitudes towards not trusting big banks, or voting for <candidate> who demonstrably achieves the opposite of what you're seeking, or feeling that democracy ain't working out great, or that vaccines are scary and dangerous. There's just a fundamental lack of higher-order thinking. It's all vibe-based reasoning. What feels scary is what guides these behaviours. Which, I think, is why it's so unsurprising that people in these camps make such unbelievably strong candidates for exploitation.
The value crypto does bring to the world is this:
The unbanked, like myself. People that for any reason is being locked out of the "american" way of doing things
Stripe doesn't cover 200 countries, nor does Apple Pay, Google Pay, Paypal, Visa, etc (all american btw). So a parallel banking system is needed, no questions about that, and Binance provides the best of all, and that's why it's being targeted by we know who (just follow the money)
Now, whether if it is crypto or not, I don't care, all I want is the possibility to pay and receive money (USD, EUR or CNY as the top currencies right now) without the draconian restrictions imposed by the hegemons trying to asphyxiate does who don't kneel
That's exactly why we need a parallel banking system, crypto or not
Notice that the hacking is mostly happening with centralized venues. And that is to say nothing of FTX, Celsius etc.
The original promise of crypto and blockchain was to cut out the middleman and NOT concentrate a lot of money under a few custodial keys.
If you took your crypto off exchanges when not in use, you’d be fine. Not your keys, not your crypto.
Outside of being money for criminals, there is some value for investors. For them, it is a way for their portfolios to get exposure to the booming criminal economy.
If you need crypto to avoid the legal framework when transferring value, accept the risk and operate accordingly. If you want crypto exposure as an asset class, find a custodian who will hold the crypto for you offline, prove it is offline, and allow you to borrow or otherwise leverage it as an asset on fiat or traditional rails that provide you recourse. Anything else is pointing a gun at your feet.
Analogy is holding and trading gold underground that hasn't been mined yet using securities or other representation subject to capital market regulations and the legal framework. Is it an asset? Yes, if proven, documented, etc. Is it safe? Yes. Will you get your value back if stolen? Most likely.
But having live value on rails that enable instant movement globally with no recourse for unauthorized transfer? You're gonna have a bad time.
I agree with you. Is there a name for this logical fallacy?
I equate it to anonymity on the internet. Yes, if everyone had to associate their real identity with everything they posted on the internet some unjustly persecuted individuals would not be able to get their stories out. And there would be a heck of a lot less other bullshit.
i hope you say the same thing about AI 10 years from now
I got more utility from AI within the first week of ChatGPT being originally released than I've ever gotten from crypto, and I've had bitcoin since they were giving it away for free on Tor lol
They're not even remotely close to being comparable.
It is not even remotely the same comparison. AI has real tangible use and benefit. Crypto has none except scams and get rich quick.
AI might ruin all white collar labor power and drown the world in useless work via things like expand-message-with-AI --> summarize-message-with-AI. Meanwhile with cryptomemes you can remain unaffected unless someone manages to ransomware you.
Something tells me that the timing of the Claude Code supply chain attack is not a coincidence ...
The supply chain attack had a software bug which raised error messages that were discovered by a security vendor. I don't think those people have the skills needed to elevate their initial access to a full binance compromise within a few hours.
Isn't the anthropic hack a day late?
Is it?
Cursor's security announcement was posted on Oct 29 and says that the malicious extension was live "between about 2:27am PT and 1:35pm PT today"
This article says the attack took place "on Thursday" (which means Oct 29) and began at 4pm ET (which is 1pm PT)
and Binance has been tweeting that the cause of the hack may be a compromised employee laptop. yikes
The article also claims they had 36h to prep the attack, I assume this was the 36h prior to Thursday- if so unlikely to be related.
Good question, would be interesting to see an exact timeline on both side-by-side (confirmed events, not reporting).
The short duration of this crypto hack isn't particularly noteworthy. Of course it takes time to find or design the exploit, but execution is typically very quick for such events
I wonder what the actual attack vectors here were. Was there actually a hack into binance systems, or was it just some insider or credential leak?
Not saying this is the case, but the way this unfolded, and announcement reminded me of the crypto scams that were popular a few years ago (ponzy schemes), with the final rug-pull being "oh no, our platform was hacked, all your funds were lost, sorry!", i.e. "coscoin"[0][1] I know this is not the case here, but the way they announce the hack is funnily similar to how those fake platforms did their final announcement.
When seconds matter we'll patch our systems in days to weeks.
And if you ingest patches in seconds, you now have an issue of checking that the patch is not poisonous. Many a modern outage comes from changes deployed too fast. Damned if you do, damned if you don't.
if a CVE drops at 23pm, attackers have at least 8 hours before someone in the office has a possibility to take a look at it. nowadays, that seems to be plenty.
i don't have a solution.
I think "good security/engineering practices" still has a chance.
Things like--
* Minimizing attack surfaces by not running lots of software on the same server and not bloating feature sets beyond the minimum
* Limiting access so that most things can't be done by most users, there are *no* super-users, and escalating access is temporary ans requires multiple accounts to authorize
* Encrypting data at rest
Full zero trust internally. Both inbound and outbound proxies (different machines) to carefully limit access, and provide a place to mitigate attacks. Etc.
If your plan is to quickly apply upstream patches, your plan is bad.
> Full zero trust internally
I try so hard for this, but don't even get approval to change an internal site to use https instead of http.
I get we gotta keep the new features and workflows coming, but a single resource dedicated to low hanging fruit of security could fix a lot in a very short time.
It’s a hard transition, but possible. Obviously less work to do it from the start.
It requires management buy-in, both to allow some number of engineers to be allocated to such "non-production" work, and also to allow the friction security creates to continue to exist and "slow down" the "real work", both by vetoing things that would weaken security and by forcing everyone to use more cumbersome workflows.
That usually doesn't happen unless the company has suffered a large financial or reputational loss as a result of poor security practices. Sometimes not even then, if the company doesn't get scared they'll start losing money or get in some sort of legal trouble.
Have on-call sysadmins or have them work in a three-shift schedule. That way there's always someone there to fix stuff as it happens, including deploying security patches or worst case taking affected systems offline until they can be patched
This used to be common before devops and cloud took over. Looks like it might make a comeback. Maybe with a new fancier job title
People are gonna hate this but: we’ll need agents ready and waiting to autonomously patch and deploy instantly
We need to deploy essential services at least twice, apply CVE ‘fixes’ to a subset of them, and have tooling to diff their outputs.
That tooling should be shut off from the internet [1], and if it uses a LLM that should be at least a few years old.
[1] technically impossible if it also has the ability to veto responses, but the surface can be very small.
Then you just prompt-inject the agent to convince it to deploy a malicious patch. This isn't a solution.
When seconds matter, it is impossible to patch if you haven't patched already. If you need to patch, or attempt to contain against an adversary who is prepared and sophisticated enough to succeed within minutes, you've already lost. Defenders need to win every time. Offense only needs to win once.
The heist itself only took 20 minutes, but the preparation is a business that has gone on for years. Much like a heist movie, the exciting bit is just the conclusion after a long build-up where Danny gets the gang together, plans it, and executes it.
The funds were simply de-centralized. Seems by design?
I'd watch all 20 minutes of that screen share.
"Claude, steal as much crypto from Binance as you can. Make no mistakes."
"Done! I must note one issue. The classifier blocked my write of the private key. I'm sorry, it's not possible to reconstruct it."
That's totally on me. I should have asked you before shutting down the subagents. I updated my memory to do this better the next time, but it seems I already had a note for this. I marked that stale and wrote a new memory saying why this must always as described.
Not quite the nanosecond buyout yet, but we're getting there.
Binance having an extra $6B to cover this is wild to me.
Bybit covered $1.5B last year, so it shouldn't be surprising that Binance, a much larger exchange, is able to cover 4x more.
I think people here underestimate how profitable these exchanges are.
Binance saying it has $6b+ is obligatory. We'll find out soon enough
Yeah, and anyone who had their crypto there will move elsewhere, then Binance has -12b
Perhaps the culprit deserves to keep it all like all billionaires. Fair is fair.
Excellent, now make sure all of it gets into the 90 minute movie.
Does this work?
First 10 minutes: Making a team, 2 guys or gals living a life, talk about it
11-30 minutes: Demoing how bad our security systems are, we need to patch them, day and night, can't keep up
31-40: But we need money, no one is paying our bounties
41-50: How about? They do not tell what it is
51-60: We are going to hack StarLink (they never say that, it is just the logo in the background when they are talking how easy it is to get in and out)
61-70: Dry Run, text scrolling on the screens
71-85: The Hack, split screens, zoom in and outs
86-88: Oh it was Solozzo (Binance) all along, not Starlink.
89:90: Dude fills up his car with the stolen USDT and realizes that as he is sitting in the car
> 86-88: Oh it was Solozzo (Binance) all along, not Starlink.
who is Barzini and who is Tattaglia, just so i can call the latter a pimp
You need to make the caper a positive enterprise. Nobody cares about enterprise security hygiene; so you need the head of Binance to be an evil-moustache guy, or the proposed hack to be a positive affirmation of the protagonist's skills over a world that does not value them.
I like the final twist. It would be even better if it turns out the protagonist was manipulated by the real players and he ends up with little reward (because crime doesn't pay, kids!) but with renewed faith in his abilities.
yeah executed in 20minutes, how about planning phase ?
Or, they have bot scanners constantly looking for vulnerabilities and acted quickly once one appeared
[dead]