Comment by shanu14
1 hour ago
according to Binance's own account so far, the first statement said it “may involve a compromised DevOps engineer’s laptop” that gave the attacker access to a service container to submit withdrawals. then on Friday, Richard Teng said the attacker “did not simply use one engineer’s permissions”, that they’d found additional points of breach, and malware built to destroy itself and its traces.
they also say there’s no evidence any private key leaked yet their own signing system signed the transfers.
That doesnt mean the key leaked - its likely in an HSM for example, but there is an API to get it to sign stuff. Access to use keys is less bad in many ways than leaking keys, but still pretty useful.