A security incident at Binance.com, Binance’s global centralized cryptocurrency exchange, may have started with the compromise of a DevOps engineer’s laptop, according to the company’s initial investigation. Binance said the attacker used access to a service container to submit fraudulent withdrawal transactions. Binance.us, which provides trading services to US residents, said it was not affected.
How the Binance hack may have started
In his initial announcement, Binance CEO Richard Teng said the incident may have begun when a DevOps engineer’s laptop was compromised.
“This gave the attacker access to the service container, where fraudulent withdrawal transactions were submitted,” Teng said.
He described the hack as “not a simple ‘one-click’ act” but “a more complex attack process”.
Raghu Nandakumara, vice president of industry strategy at cybersecurity platform Illumio, said the incident could indicate that engineers were “talked into taking a test” and that “malware (malicious software) got onto their laptops during the test.”
Nandakumara said that, because the laptop already had sufficient security privileges, early reports suggested it became a “route for the attacker to directly access the production environment and from there to the wallet.”
Attackers used techniques to conceal their activity
Teng later said the hack was “not carried out by one person”. He added that the hackers used sophisticated techniques, including “self-destruct mechanisms”, to cover their tracks.
“You can build a safe with a mathematical firewall, but if the individual with the key can be tricked, the safe will be opened,” said Dr. Clive Summerfield, director of AI security biometrics company FARx.
Source: www.bbc.co.uk