Binance hackers used fake job interview to breach PC before $6.3B attack

jluxenberg

Wow yikes! On the one hand -- it's obviously a bad idea to use your current employer's laptop for a job interview. But social engineering takes many forms and anyone could be suseptible. Do we need to start carrying liability insurance (like doctors do)? There are so many hazards these days working in tech which can cause you to be liable for huge amounts of damage. Using agents seems fraught too; they can easily go "off the rails" and take actions you didn't intend.

koeliga

This a known method now of social engineering. See this post from last year: https://news.ycombinator.com/item?id=45591707 Still crazy tho that one dev's compromised device could withdraw 6 billion...

Arcuru

It does seem like there has been an increase in that social engineering approach. The Rust ecosystem was being targeted recently too, enough that they felt the need to warn people about it: https://blog.rust-lang.org/2026/09/17/targeted-attacks/

ChrisArchitect

Some more discussion: https://news.ycombinator.com/item?id=50353353

ada-h00k

I don't quite understand why so many people still don't use containers. You can easily use devcontainers in VS Code. That way, each repository has its own container, and the risk of infecting your system with malware is much lower.

jon128

A compromise of engineers' endpoints should not lead to a compromise of wallet keys. > A limited number of engineers at the company have direct access to wallets Ah, so security models I spec'd and implemented for operating/administrating sensitive resources in/of production or just anything non-prod in general over the last decade, which never ever allow human users direct access outside of "break glass" (immediately instant-termination offense and lawsuit from company against employee if used frivolously), are superior to Binance's security, apparently. inb4 "but how do u do tings den": the model has only so much cleverness but not that much, I'll keep it proprietary for now thx Ya'd think a place like Binance would use a managed Qubes OS offering for endpoints. And yes, Qubes can be made derpy-derp-friendly with a custom UI layer and backing of provider's cicd for any/all apps including Windows apps like MS Excel with full GPU support.

readthenotes1

So Binance lets its developers download code onto machines that have access to production material willy-nilly? Seems like they have some developers who don't take security seriously. I guess it's other people's money after all.

cloudie78

I’m sorry what kind of a circus are you running where people with prod access run random untrusted code on the same boxes with credentials to prod systems?

CqtGLRGcukpy

The article in Fortune [1] says "According to a Binance spokesperson, employees with non-public-facing roles are not allowed to maintain LinkedIn profiles." How common is that? I understand many companies asking employers to not list where they work (for security reasons). But, not allowed to have a LinkedIn profile, period. [1] https://fortune.com/2026/11/03/binance-hack-details-linkedin...