CircleCI

DevOps Engineer's Compromised Laptop Triggers $6.3 Billion Binance Withdrawal as Attackers Abuse Internal Access

A compromised laptop belonging to a DevOps engineer at Binance allowed attackers to reach a service container and initiate unauthorized transactions totaling approximately $6.3 billion. The keys to the exchange wallets were never stolen; instead, the platform itself signed the transactions because the requests originated from within the trusted environment. Similar incidents at CircleCI, Uber, and LastPass demonstrate how static credentials and broad production access on engineer workstations remain a persistent weak point across organizations. The article also examines how generative AI tools accelerate both secret leakage and exploit development, citing cases involving Samsung engineers and malicious Nx packages that targeted AI coding agents. Recommendations include replacing long-lived credentials with short-lived tokens via SSO or OIDC, limiting production access, and enforcing strict review processes for AI-generated manifests and agent instructions.