Binance engineer's job-application phishing led to $6.34B loss: full attack chain
ccerrato147 · x · 2026-11-04
Security engineer ccerrato147 walks through Binance's published supply-chain attack timeline (June–October): an engineer answered a recruiter, downloaded a tampered Homebrew installer found via search for an AI coding tool, and the laptop was compromised — ultimately costing $6.34B, more than half of Monaco's GDP.
The proposed fix: dev tools must come from an internal signed catalogue, and macOS refuses to run any binary outside it.
More from coding & agent
- GhostDraw: a hobbyist turns hand-drawn sketches into app diagrams with tldraw and AI — Dhananjay_Tech · 2026-11-04
- CoworkOS Debuts: Three-Layer Agent Coworker Framework Lifts Qwen3.6 by 9.76 Points — KyeGomezB · 2026-11-04
- DOLORES: Training-Free Meta-Scaffold Lifts 8B Models Past 32B Baselines — StellaLisy · 2026-11-04
- Berkeley-affiliated StarTrail open-sources a deep research benchmark and paper-search toolkit — CShorten30 · 2026-11-04
- AI job-search framework built on Claude Code hits 69.3k GitHub stars — adnan_hashmi · 2026-11-04
- DuplexAgent-RSI separates live speech from async agent work in voice assistants — jiqizhixin · 2026-11-04