October Binance Security Incident: Initial Findings and Response Update

Absolutely stunning that a private company has the free cash to repay and absorb a loss of $6.3 billion. I'm clearly in the wrong business.

Interview malware, again.

They still don't say how the ability to subvert a production container allowed the attacker to then subvert a fancy EIP-7702 MPC signature scheme that is supposed to depend on multiple parties (the whole idea being that if one party is breached the scheme remains trusted).

"the attacker logged onto Software Engineer C’s computer, used the credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script to launch the attack."