Opsek founder says Binance attackers may have had access for weeks before the hack

Fake job offers as a way into corporate networks are a known tactic, most prominently used in the 2022 Ronin Bridge breach that targeted Sky Mavis through a bogus recruiter pitch to an engineer. Binance's preliminary timeline follows a similar script: three engineers were compromised first, their credentials harvested, and access escalated step by step until it reached the internal wallet signing service that moves customer funds, rather than any breach of public-facing systems.

Binance's disclosure that transfers kept moving after withdrawals were frozen means the attackers held signing authority independent of the exchange's own suspension controls, a gap security teams will now have to close by separating withdrawal switches from wallet-signing permissions. Employees at exchanges become higher-value targets than infrastructure, pushing security budgets toward device monitoring, credential rotation and stricter verification of internal job assignments. Users gain little new protection immediately, but can expect slower internal approval chains and more friction on large withdrawals while Binance rebuilds trust in its signing process. (per ambcrypto.com)

The episode tests how far 'assume compromise' security models can travel beyond banks and defence contractors into crypto exchanges that still market speed and frictionless custody as selling points. Treating every employee device as potentially hostile cuts against the operational ease that lets Binance move customer funds at scale, and raises a genuine trade-off between usability and containment. Whether exchanges adopt that posture, or treat this as a one-off breach, will shape how much scrutiny centralized custodians face compared with the decentralization they often claim to support. (per cryptobriefing.com)

Binance has not yet published a full post-mortem fixing exactly how many weeks the attackers held access before withdrawals were suspended, nor named the three engineers' roles within its security hierarchy. The next marker is whether Binance's completed investigation, once released, confirms the weeks-long dwell time Opsek's founder flagged, which would determine whether this becomes a case study in detection failure rather than just initial compromise.