Binance hackers used fake job interview to breach PC before $6.3B attack(www.reuters.com)
59 pointsby entryleveljobsc6 hours ago6 comments
  • jluxenberg4 hours ago
    Wow yikes! On the one hand -- it's obviously a bad idea to use your current employer's laptop for a job interview.

    But social engineering takes many forms and anyone could be suseptible.

    Do we need to start carrying liability insurance (like doctors do)? There are so many hazards these days working in tech which can cause you to be liable for huge amounts of damage. Using agents seems fraught too; they can easily go "off the rails" and take actions you didn't intend.

    • smnrchrds2 hours ago
      A one million dollar liability insurance policy wouldn't have helped much with a six billion dollar loss.
    • toyg3 hours ago
      Contractors in the UK are already required to have liability insurance, or any large business won't touch them with a barge pole.
      • dboreham3 hours ago
        Same for contractors in the US, for the 20-odd years I've been doing it.
    • christophilus4 hours ago
      Yeah. Pretty wild. I've never done that, and wouldn't, but I know folks who would. If I ever do any interview work on my laptop, it's always sandboxed, but generally, I just nope out of such interviews, anyway. It's usually one of many red flags.
  • Arcuru4 hours ago
    It does seem like there has been an increase in that social engineering approach. The Rust ecosystem was being targeted recently too, enough that they felt the need to warn people about it: https://blog.rust-lang.org/2026/09/17/targeted-attacks/
  • ada-h00k2 hours ago
    I don't quite understand why so many people still don't use containers. You can easily use devcontainers in VS Code. That way, each repository has its own container, and the risk of infecting your system with malware is much lower.
    • brazukadev10 minutes ago
      I prefer to do the vetting before running other people's code. If someone asks me to do a interview project that has a virus on it, I will just waste my time even if I don't get hacked.
  • koeliga4 hours ago
    This a known method now of social engineering. See this post from last year: https://news.ycombinator.com/item?id=45591707

    Still crazy tho that one dev's compromised device could withdraw 6 billion...

    • proto-n3 hours ago
      Multiple wtfs: one dev can access 6B; the dev does job interview from the work laptop; the work laptop has permission to run random executables with it having access to sensitive stuff. Maybe they went on to hack into stuff from the dev's laptop that they should not have had access to.
    • dboreham3 hours ago
      Of course as usual the legacy media article fails to address that key issue. If I had to guess I'd say that their system uses some sort of HSM to sign chain transactions but there are not strong controls on what txn it will agree to sign. Therefore somewhere in their code there's a place where you can just insert your transaction du jour and it'll go through. Once you have that scenario anyone who can modify the system's code will be able to steal as much money as they want. So the "developer laptop" may have only been used to push a PR or perhaps change code via a more direct route -- publishing a new container image or other build artifact. Using AI tools I think it would be quite feasible to point an agent at the pile of code on that laptop and just ask it "what code do I need to change to allow any transaction to be sent on-chain"? So the attacker didn't need to have deep knowledge of the system.

      Edit: Binance has now published some details on the attack. The attacker subverted an EIP-7702 contract rather than as I theorized an HSM authorization process.

  • jon128an hour ago
    A compromise of engineers' endpoints should not lead to a compromise of wallet keys.

    > A limited number of engineers at the company have direct access to wallets

    Ah, so security models I spec'd and implemented for operating/administrating sensitive resources in/of production or just anything non-prod in general over the last decade, which never ever allow human users direct access outside of "break glass" (immediately instant-termination offense and lawsuit from company against employee if used frivolously), are superior to Binance's security, apparently.

    inb4 "but how do u do tings den": the model has only so much cleverness but not that much, I'll keep it proprietary for now thx

    Ya'd think a place like Binance would use a managed Qubes OS offering for endpoints. And yes, Qubes can be made derpy-derp-friendly with a custom UI layer and backing of provider's cicd for any/all apps including Windows apps like MS Excel with full GPU support.