Binance confirmed a security incident involving a compromised DevOps engineer's laptop that allowed an attacker access to a service container to submit unauthorized withdrawal transactions.

{
  "signal_id": "acbdacc7-e937-5843-a532-dedefd8e913e",
  "signal_type": "reddit-company",
  "signal_subtype": "cybersecurityIncident",
  "detected_at": "2026-10-30T03:10:26+00:00",
  "company": {
    "name": "Binance",
    "domain": "binance.com"
  },
  "data": {
    "nsfw": false,
    "stage": "confirmed",
    "awards": 0,
    "timing": "in_progress",
    "topics": [
      "security",
      "breach",
      "devops",
      "access control"
    ],
    "post_id": "1xj4flc",
    "summary": "Binance confirmed a security incident involving a compromised DevOps engineer's laptop that allowed an attacker access to a service container to submit unauthorized withdrawal transactions.",
    "category": "breach",
    "comments": [
      {
        "url": "https://www.reddit.com/r/devops/comments/1xj4flc/comment/19rv0q5xiik2t/",
        "depth": 0,
        "score": 280,
        "author": "lab-gone-wrong",
        "excerpt": "To be 100% clear, the (any?) devops engineer could have done this at any time? Lmao",
        "posted_at": "2026-10-30T03:25:30.000Z",
        "author_url": "https://www.reddit.com/user/lab-gone-wrong/"
      },
      {
        "url": "https://www.reddit.com/r/devops/comments/1xj4flc/comment/19rv06b29mz36/",
        "depth": 0,
        "score": 84,
        "author": "Fatali",
        "excerpt": "Quick question:\n\n How would a real bank treat credentials with that level of control?",
        "posted_at": "2026-10-30T03:13:08.000Z",
        "author_url": "https://www.reddit.com/user/Fatali/"
      },
      {
        "url": "https://www.reddit.com/r/devops/comments/1xj4flc/comment/19rvegv5157vl/",
        "depth": 0,
        "score": 40,
        "author": "micalm",
        "excerpt": "> We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.\n\n Funny how a company can control a decentralized cryptocurrencies flow just because they fucked up. Just like a fide bank... but without the security, experience, procedures and control.",
        "posted_at": "2026-10-30T08:33:36.000Z",
        "author_url": "https://www.reddit.com/user/micalm/"
      },
      {
        "url": "https://www.reddit.com/r/devops/comments/1xj4flc/comment/19rv1q61i2bdx/",
        "depth": 0,
        "score": 19,
        "author": "deadthoma5",
        "excerpt": "\"Your funds are safu\"",
        "posted_at": "2026-10-30T03:47:56.000Z",
        "author_url": "https://www.reddit.com/user/deadthoma5/"
      },
      {
        "url": "https://www.reddit.com/r/devops/comments/1xj4flc/comment/19rv7k0smuhwl/",
        "depth": 0,
        "score": 19,
        "author": "DolGuldurWraith",
        "excerpt": "I definately know what happened as something similar happened with my colleagues as well as 2 months and withdrawal of $2 million was done.\n\n So this is how it goes. Fraudsters look for people in crypto related finance company and devops/cloud team assuming they have access to eks cluster from their laptop.\n\n They then reach out on LinkedIn for a job, in my colleague's case they reached out by off",
        "posted_at": "2026-10-30T05:58:37.000Z",
        "author_url": "https://www.reddit.com/user/DolGuldurWraith/"
      },
      {
        "url": "https://www.reddit.com/r/devops/comments/1xj4flc/comment/19rv1rt5wao11/",
        "depth": 0,
        "score": 12,
        "author": "Highfivesghost",
        "excerpt": "I didn’t really think about it, but DevOps engineer might be higher targets due to the access they have compared to other engineers",
        "posted_at": "2026-10-30T03:48:57.000Z",
        "author_url": "https://www.reddit.com/user/Highfivesghost/"
      },
      {
        "url": "https://www.reddit.com/r/devops/comments/1xj4flc/comment/19rv0l11u2c6d/",
        "depth": 0,
        "score": 12,
        "author": "meccaleccahimeccahi",
        "excerpt": "One fucking laptop? No way they were that stupid. Well…",
        "posted_at": "2026-10-30T03:22:18.000Z",
        "author_url": "https://www.reddit.com/user/meccaleccahimeccahi/"
      },
      {
        "url": "https://www.reddit.com/r/devops/comments/1xj4flc/comment/19rv5q7ywc4yt/",
        "depth": 0,
        "score": 10,
        "author": "Negative-Thinking",
        "excerpt": "I have a hard time understanding how a laptop access could have helped here. You still need passwords, 2fa, vpn etc to get into different systems. Did they have none of that?",
        "posted_at": "2026-10-30T05:17:38.000Z",
        "author_url": "https://www.reddit.com/user/Negative-Thinking/"
      }
    ],
    "evidence": [
      "[image] Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.",
      "[image] We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.",
      "[comment u/micalm] We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far."
    ],
    "link_url": "https://i.redd.it/mnmfashauiyh1.jpeg",
    "virality": "very_high",
    "image_url": "https://i.redd.it/mnmfashauiyh1.jpeg",
    "post_date": "2026-10-30T03:10:26.000Z",
    "post_kind": "image",
    "sentiment": "negative",
    "subreddit": "devops",
    "event_date": "2026-10",
    "post_flair": [
      "Security"
    ],
    "post_title": "Binance hack and a DevOps laptop",
    "prominence": "core",
    "source_url": "https://www.reddit.com/r/devops/comments/1xj4flc/binance_hack_and_a_devops_laptop/",
    "entity_role": "subject",
    "post_author": "sinunmango",
    "upvote_ratio": 0.9875776397515528,
    "mention_count": 11,
    "mention_surge": true,
    "subreddit_url": "https://www.reddit.com/r/devops/",
    "total_upvotes": 628,
    "comments_total": 188,
    "total_comments": 187,
    "post_author_url": "https://www.reddit.com/user/sinunmango/",
    "signal_category": "event",
    "comments_included": 13
  }
}

curl https://signals.autobound.ai/v1/signals/acbdacc7-e937-5843-a532-dedefd8e913e \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"binance.com","limit":20}'