Comment by Aboutplants
21 hours ago
Or, they have bot scanners constantly looking for vulnerabilities and acted quickly once one appeared
21 hours ago
Or, they have bot scanners constantly looking for vulnerabilities and acted quickly once one appeared
No. You'd need to know how Binance worked in some very deep level of detail. E.g. that there's a way to force signing of high value transactions with no rate limiting or countersignature, then how to mount an attack on that code through lax controls via a developer machine. That's not something you learn through casual scanning.
Well, it depends really. Let's consider this scenario:
Binance has cold wallets and hot wallets. The hot wallets used to be small and therefore low value, but have grown to be huge, without anyone really paying attention. The hot wallets have much less ceremony attached to moving money, as they are required to move money multiple times a second to track customer inflows/outflows from the system. There are no controls or transaction limits on the hot wallet because it's just a bitcoin wallet (or set of wallets). The hackers got access to the system via the dev machine, found the hot wallet keys in the system (which it requires to function), and simply started draining it of funds, it turned out the hot wallets contained a LOT of funds.
That doesn't require in-depth knowledge of Binance operations, all they need is access to hot wallets via the keys which we know the app would need to have in order to use it.
The lack of controls on the Binance side here is astounding, but it does appear like they had no safeguards, limits or monitoring on the hot wallet in spite of the money involved, or if they did they kicked in too late.
Partly this is a problem with the crypto itself which underlies their system: it's designed to be permissionless and without controls slowing down or reversing transfers.