PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Binance hack: how a compromised developer laptop can lead to a $6.3 billion breach

aikido.dev | incident
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

‍TL:DR: the $6.3 billion Binance hack may have started with a compromised DevOps engineer's laptop. Binance has since said its investigation found additional points of breach, and it has not said how the laptop was compromised. We see attacks on developer devices every day - just last week Aikido blocked nearly 500 malware attacks. Here is how one compromised laptop can lead to a service that moves money.
Published
Collected

Related coverage

incident · aikido.dev
Popular code generator for TanStack Query hit by supply chain worm
This incident coverage highlights active npm package poisoning and practical supply chain defensive lessons.
incident · aikido.dev
Two popular Rust crates arrayref and append-only-vec compromised in Supply Chain Attack
This incident coverage highlights observed attacker activity and practical defensive lessons.
incident · aikido.dev
Keyv and friends compromised in active Shai-Hulud supply chain attack
Attackers hijacked the maintainer account behind keyv (127M weekly downloads) and its caching-package family, injecting a credential-stealing Shai-Hulud worm that spread to 444+ npm packages.
incident · aikido.dev
Four incident-response decisions from the Hugging Face breach
The incident shows how thousands of individually weak agent actions can assemble into a multi-day compromise. Runtime correlation, credential lineage, canary signals and rebuild readiness are essential when machine-speed activity overwhelms conventional alert thresholds.
incident · aikido.dev
SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts
It's not often we see a supply chain attack on RubyGems. But with summer vacations in full swing, perhaps we should have expected one. It was still a surprise when I opened the triage queue this morning and found a suspicious new package waiting.
incident · aikido.dev
AsyncAPI npm packages backdoored via GitHub Actions
Attackers abused GitHub Actions to publish backdoored AsyncAPI npm packages, showing how CI credentials and release automation can become the shortest path to ecosystem compromise.
Back