AFAIK they gained access to a DevOps guy's laptop with too many privileges and just made a bunch of withdrawals into their own wallets, so they have their keys.
The only hope is that most of it gets frozen in some way or another, but if even only 1% gets through they'll still have made about $65M
Most exchanges don't use a single wallet per user, but have a small pool of wallets that all their customers share, and they just do the bookkeeping of the balances of each account. That lets them group many transactions together into a single larger transaction, or avoid a transaction entirely if it's between two users on their exchange.
So that pool of wallets that stores all their customers funds needs to be managed by the exchange somehow, meaning there's going to be some sysadmins/devs/etc that have access to parts of the system that deal with those wallets, and possibly also the keys to those wallets (which it looks like was the case here).
It's unlikely an engineer would have direct access to anything. That should be at least behind multisig. But you never know, people do dumb shit and there might have been critical private keys mounted in some random container from a subsystem made 6 years ago that was never replaced or tracked because it never made noise.
I don't work at Binance, but having been in that exact situation (SRE @ Crypto company with lots of assets, attacked by North Koreans), I'm guessing DevOps guy gave access to some CI/CD, `kubectl exec` what have you which allowed attackers to play with APIs, some settlement mechanic, some smart contract update pipeline. You don't really have to attack wallets if something less secure controls them.
This really could stem from nothing, excessive permissions in a GitHub token can go very leveraged properly.
It's so crazy. As a user, you need to triple authenticate with all sorts of gates to withdraw money but here's a dev guy who can just magically, without any secondary authorizations (as far as I can tell), transfer billions. No devops/sys admin should have access to live wallets with real funds
Its more possible devops guys had access to something like AWS secrets or API tokens or some tool that generates API tokens or access to CI/CD which could grab access to one of the above
1) The coins belonged to customers, but were in Binance wallets (thus under control of Binance) - that's how exchanges work. You send them your coins, then you can trade.
2) You can't freeze Bitcoin transactions (well, the crypto bros running it could if their majority wanted to, but they don't want to), but some of the stolen coins were stablecoins like USDT and USDC.
And fiat-backed stablecoins are ipso facto centralised (someone needs to 1) take receipt of fiat and issue coins against that, 2) custody that fiat and hold on to it reliably, and 3) return the fiat when given back the coins). You can then with the private key send the coins back to the issuer, but the issuer can refuse to give you the fiat.
However, many stable coin smart contracts are even more powerful: they give the issuer an authorized control account that can add a wallet address to a blacklist. The contract checks that list whenever someone tries to move the token; if the address is blocked, it rejects the transfer. Then the balance can’t be moved.
There’s a small difference: USDC blocks transfers both to and from a blacklisted address. USDT generally blocks the address from sending USDT, though it may still receive USDT. Tether’s contract also has a separate function that can destroy tokens held at a blacklisted address; that is distinct from simply freezing them. Note that when they destroy tokens, Tether keeps the cash - so it's a transfer from the criminals (or whoever held the tokens) to Tether. (Tether can then re-issue the coins and hand them back to law enforcement or the victim, but that's a separate step.)
I don't know man... by now we've had like 1 year of pretty much weekly improvement and new better models since Opus 4.5 and although I see a lot of AI everywhere and personally use AI a lot, around me in the real world with non-technical everyday people it's been mostly a shift from "just google it" to "just ask chatgpt".
I am (was?) a coder and also feel how you feel in one way or another. I love the productivity while still sort of trying to come to terms that typing lines of code as I've done for the past few decades is pretty much over forever.
Now, I'm still pretty sure that, as smart as AIs become, a lot (or most) of people just can't be bothered with this stuff and just want stuff done.
I don't think there will ever be a future, as I've seen prophesized around, where anybody that wants some sort of software or functionality, etc will just vibe code it or prompt for it, launch agents, etc instead of just asking somebody else to do it as always.
Sure, some percentage will adopt AI immediately and it will definitely open a lot of opportunities, but I just don't see it taking over everything everywhere in the grand scheme of things.
There's also a big gap into making things actually usable for everybody and their grandmother. Apps are cool and all, but the constant release of model after model, new feature tours every time we open an AI app, weird opaque product names, having to pick low, medium, high, xhigh, ultra, etc, mixed and complicated permissions, sandboxing stuff, connecting stuff, etc. These are all stuff we here on hn do on a daily basis and is second nature but that is not the norm.
Only now we're starting to see some new scientific and math proofs, so maybe that will be what makes AI actually universally revolutionary once it starts making actual new advances. But now we'd be mostly entering into AGI territory and that's a whole other rat's nest.
So, let's first see how we, as a society, accept the proposed future of robots everywhere (probably the big 2027 thing maybe?), then let's talk end of humanity. :)
TL;DR: Still not fully convinced all of this will live up to the hype. And if it does, it will take a few generations. We're a very complicated species living in complex societies and we're kind of being sold an impossible utopia by people that have very little experience living down in the real world.
I don't know about this guys, we used to have phones and as soon as we had the chance to use text messages instead we went all in on them. I personally, and many of the people I know avoid voice calls as much as possible.
So if I can't really be bothered to speak with other humans, why would I want to speak out loud with an AI? I may be wrong and soon we'll all have Jarvises, HALs and Samanthas but not sure the adoption will be as fast and broad as these companies want to makes us believe.
People avoid voice conversation because they don't want to deal with human live interaction. Most people don't mind talking to themselves, as sad as it sounds. I'm guilty as well.
As someone who needs glasses to use computer, it's really convenient to be able to use voice for interaction, also while driving or at home in the kitchen. I'm waiting for good smart glasses as well, since I don't want to have to keep taking my glasses out just to check any piece of information -- menu, price tag, train time, and so on.
In my (probably naive) humble opinion, the entire population of the USA should benefit from knowing their leadership are corrupt and only interested in enriching themselves and their peers.
But having seen the huge amount of American citizens that spend their days justifying the actions of these corrupt politicians and bi/trillionaires where they apparently can do no wrong, I'm thinking that nobody will really benefit from this and it will be filed under "business as usual".
Great reply, this hits the nail in the head and is pretty much exactly how I spent my day. Just reading, waiting and stressing while being essentially in the dark about the whole thing.
I'm assuming the next few days will probably confirm if this was mostly FUD or not.
Even being the creators of React still wasn't enough to fix their shitshow of a website with a bazillion anti-patterns and the worse, most annoying UX of all time.
> Multiple times along the way, the agent’s “chain of thought,” in which an agent writes down its reasoning steps, indicated that the model itself was questioning if its actions were “ethical,” but it ultimately proceeded.
Everything's fine guys, nothing to see here! Look at the flying car!
The only hope is that most of it gets frozen in some way or another, but if even only 1% gets through they'll still have made about $65M
reply