Security Leaders Weigh In

John Bruggeman, vCISO at CBTS:

A $6.3 billion theft started with one compromised laptop, there is a security control that can address that issue.

Binance has said that this was not one person’s permissions being abused, which is a good start. From a cyber perspective no single person should have that much authority. But I’d argue that detail makes the real question more interesting, not less: if it took a multi-step attack chain across multiple points of breach to pull this off, and the end result was still losing over $6 billion in crypto, the attack chain, the withdraw process, never hit a control that required an independent human or system outside the compromised path to approve it. Ooops. That's the cybersecurity gap. A gap I would have expected to be found in an audit.

There is a control for this kind of risk called segregation of duties (SoD). Stopping one person from entering the payment request and approving the payment request is why segregation of duties is in place in virtually every bank. SoD is not about whether one person’s access was ‘excessive’ on paper. It's a design principle: no single compromised person, account, device, or service account, should be able to both initiate and finalize movement of funds at this scale.

The response afterward was good, pretty darn good actually, and shows what a mature ecosystem looks like when a theft like this happens. Chainalysis and TRM say roughly $2.7–2.8 billion was frozen within the hour by stablecoin issuers and exchanges working in parallel, leaving the attacker with about $2.4 billion in assets no one can freeze. Freezing more than half of the stolen crypto in an hour is real, fast, coordinated work. It’s also, by definition, incident response. IR is not prevention. Segregation of duties is the control that's supposed to stop the money from moving in the first place, regardless of how many systems an attacker had to touch to get there.

This is my read on the control gap, not Binance’s own conclusion, and I don’t have all the details. If your organization moves money, collects funds, writes checks, you want to ask yourself, where is my SoD? Can automated systems move money on their own, without oversight?

Mayuresh Dani, Security Research Manager, at Qualys Threat Research Unit:

The Binance hack happened because of a compromised DevOps employee laptop. Was it a vulnerability, or social engineering? Only time will tell. Every ransomware post-mortem has ended the same way — the attacker got in using a boring method, and the money left through crypto. So, when the biggest crypto exchange gets taken by the same boring endpoint compromise everyone else fights, the urge to say “welcome to our world” seems like a befitting reply. More so, when crypto turned ransomware from a nuisance into an industry, and CISOs had to bear the consequences. 

Crypto solved a problem that allowed threat actors to collect the money without getting caught, as before crypto, extortion at scale had a logistics problem. Remove crypto from the equation and this activity turns into data-theft-and-leak schemes that never needed a payment in the first place.

The engineer’s laptop that led to a multi-billion-dollar loss asks a question of what your own developer endpoints can reach. This too is just a payment method and not the cause of compromise.

Jason Soroko, Senior Fellow at Sectigo:

Attackers do not need to steal a crypto wallet’s keys if they can get the platform to authorize withdrawals for them. Binance says its initial findings point to unauthorized withdrawals through internal systems, with no evidence so far of leaked wallet keys. A blockchain can verify a transaction’s signature without knowing whether the owner intended the payment. Protecting those keys therefore requires control over every system allowed to use them. 

Exchanges should test whether one breach can compromise both a withdrawal request and the checks meant to stop it. Requiring several approvals offers little protection if the attacker can control them all. Independent checks on recipients, withdrawal limits and automatic pauses for unusual transfers can help contain losses. Binance’s promise to cover losses matters to customers. Its investigation also needs to explain how unauthorized withdrawals passed its controls and what will prevent a repeat. 

Robert Coles, Senior Manager of Threat Intelligence Security at Black Duck:

The $6.3 billion number is obviously going to get a lot of attention, but I believe the more important question is how the attackers were able to get from an initial compromise to moving assets at that scale. If an engineer’s laptop was the initial entry point, that’s certainly relevant, however, it doesn’t explain the overall impact. We must assume that endpoints and credentials are going to get compromised. The bigger question is what happened after that initial access and why the controls in place weren’t enough to stop it from becoming a much larger incident.

I’d also be careful about getting too far ahead of the investigation on attribution. There are certainly indicators pointing toward North Korea, particularly given the history of targeting cryptocurrency organizations, but I’d like to see more of the technical details around the intrusion before drawing any firm conclusions.