thaidn
Verified account This account is verified. Learn more@XorNinja
Chief at @calif_io | MAD Bugs: blog.calif.io/t/madbugs
555 Following 7.7K Followers 1.8K Posts
Latest posts 5
CICD strikes again.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/ann…View quoted post on X
I blame the crypto API. It should make this kind of mistake impossible.
That is one hell of a typo.View quoted post on X
Vietnamese rulez!
The critical Brotli RCE vulnerability discovery came out of our large scale infrastructure code scanning efforts
Great research by @k_tr4n and @_sy1vi3 in assessing the widespread impact of this bug
Update your Node.js, Bun, Envoy, anything using Brotli ASAP!View quoted post on X
I just remembered why Brotli looked vaguely familiar: I worked on it at Google. I even co-authored an RFC [1]. Hopefully they haven't found my bugdoor 😅
Joking aside, CRIME [2] led me to work on things like Brotli and HPACK, the header compression scheme used in HTTP/2.
That was the magic of working at Google. They operated at such a huge scale that a few weeks of your work could become part of a widely used Internet standard. One of my fondest memories is helping audit QUIC and writing little bits of crypto code for it.
Before I left Google, a teammate on the Tink [3] team told me he believed Tink would last 50 years, outliving everyone on the team. Tink is now in its 10th year. 40 more to go!
I also learned that breaking things is fun, but lasting contribution often comes from building things that make the Internet faster and safer.
That same belief shapes much of our work at Calif. People know us for our offensive security research, but we've also done a lot of security engineering to harden systems and mitigate attacks, from large-scale Rust migrations to fast sandboxing or reducing zero-click attack surface in mobile apps.
We'll be sharing some of that work soon. Stay tuned!
[1] rfc-editor.org/rfc/rfc9841.txt
[2] en.wikipedia.org/wiki/CRIME
[3] github.com/tink-crypto
Joking aside, CRIME [2] led me to work on things like Brotli and HPACK, the header compression scheme used in HTTP/2.
That was the magic of working at Google. They operated at such a huge scale that a few weeks of your work could become part of a widely used Internet standard. One of my fondest memories is helping audit QUIC and writing little bits of crypto code for it.
Before I left Google, a teammate on the Tink [3] team told me he believed Tink would last 50 years, outliving everyone on the team. Tink is now in its 10th year. 40 more to go!
I also learned that breaking things is fun, but lasting contribution often comes from building things that make the Internet faster and safer.
That same belief shapes much of our work at Calif. People know us for our offensive security research, but we've also done a lot of security engineering to harden systems and mitigate attacks, from large-scale Rust migrations to fast sandboxing or reducing zero-click attack surface in mobile apps.
We'll be sharing some of that work soon. Stay tuned!
[1] rfc-editor.org/rfc/rfc9841.txt
[2] en.wikipedia.org/wiki/CRIME
[3] github.com/tink-crypto