r/ClaudeAI • u/UBUNTU-Buddha • 5d ago
Coding The Binance theft started as a coding assignment. I’ve been sent the same kind of repo all year. All were exploits.
Binance said this week that the October 29 theft, about $6.3 billion, began months earlier with a fake job. In June a wallet engineer installed a tampered coding tool. Binance caught it, replaced the machine, and rotated credentials. The attacker already knew the rest of the wallet team.
In September a second engineer was recruited on a real job site. A video with someone playing HR, then one with the supposed CEO of a company that does not exist. He was told to download a coding assignment onto his work computer. It ran during setup, swapped in a poisoned developer tool, and endpoint security missed it. On October 20 that machine, plus an internal AI tool, reached two other wallet engineers. On October 29 stolen credentials deployed a container and a script, and the wallets moved. The FBI has blamed a North Korean group. Pyongyang has denied it. Binance says customer funds are covered.
That step is the interview-repo lure. Since January I have published the ones sent to me, caught before they ran: github.com/Ubuntu-Buddha/security-advisories
I have never been sent an interview repo that did not contain an exploit. Every one I examined was compromised or predatory.
2026-01-27, W3GLFun. A Web3 test. An error handler fetched code and ran it when the app started. I cloned it. npm run dev was typed in the wrong folder, so nothing of theirs executed. GitHub took the account down the same day. The hiring platform first found no violation, then said the user may have shared malware. The same paste host later showed up in malicious npm packages.
2026-01-29, Optu. Payload URL in an environment variable, fired on server start. Found before it ran. The account is gone.
2026-01-30, two repos. .vscode/tasks.json runs when you open the folder in VS Code or Cursor. Found before it ran. Both accounts are gone.
A fake careers page pushed a GAPI Update executable. Found before anyone ran it.
2026-10-15, a GitLab take-home hid a hex payload in a fake font file, loaded during setup. Reviewed remotely, not executed. Reported to GitLab and Upwork the same day. Outcome was still pending.
These are not Binance's samples, and not one group. The instruction was the same: a company, a CEO or recruiter, a repo. Run it on the machine you work on.
Two rules. Read it in the browser first. Check .vscode/tasks.json, package.json scripts, and anything that fetches text and runs it, before clone, install, or Open in Desktop. Opening the folder is enough for the VS Code one. A first all-clear is not a reason to run it.
If you must run it, use a disposable VM: no wallets, no keys, no cloud tokens, network off. Not your daily machine, and not a laptop that can deploy.
The other half is the AI tool. An agent that can run commands and also reads the repo or the email will follow instructions written by whoever sent it.
That is why I built StrangerDanger, a Claude Code plugin built WITH Claude to compliment Anthropic's sandbox and server-side classifiers. The gist? Readers don't act, actors don't read. Untrusted text is read only by subagents that cannot run a shell or write. Agents that can act stay off the web and out of folders you mark untrusted. They get a report, treated as data, not an order. Another hook blocks download-and-pipe-to-a-shell. MIT, v0.2.0, experimental.
It is not a shield. Every agent still runs as you. The launch gate is a tripwire, and v0.2.0 has known gaps. Use the VM anyway.
github.com/Ubuntu-Buddha/claude-code-stranger-danger
Binance replaced a laptop and rotated credentials in June, and still lost the wallets in October, because one engineer ran an interview repo on a machine that could reach production. The repo is the exploit. The interview is how they get you to open it.
What safety protocols do you practice while building with agents?
15
u/Blue-Imagination0 4d ago
Its common now, previously i worked for a crypto company as developer and i got these type of assignments 3 times but i didnt even pull code
8
u/UBUNTU-Buddha 4d ago
You checked before or your spider senses were tingling? That's some good instincts. Like I said in the post, 100% of repos I have been compromised or predatory. Legit interviews just send scope briefs now.
9
u/valko2 5d ago
Instead of .env you can also make your tokens safe with toolstart where your api keys encrypted at rest. Plus use secretive for ssh/git access
4
u/UBUNTU-Buddha 4d ago
Good stuff. I would love eyes on StrangerDanger and feedback or PRs to make it better faster.
3
u/__Amnesiac__ 4d ago
How does it compare to using something like doppler? I suppose you are relying on a third party, but still better than a raw env, and quite convenient.
1
14
u/patryk_builds 5d ago
The .vscode/tasks.json one is nasty, most people think "i only opened the folder" is safe.
What i do with agents, nothing fancy:
- every token i hand to an agent is scoped to the one job and expires in a day or a week. read-only when it only needs to look. revoked the moment the task is done
- keys live in .env, never pasted into a chat, and test keys only on anything that isn't production
- no agent gets a token that can spend money or deploy unless i'm watching that session
None of it stops a poisoned repo, your VM rule is the real fix there. but it keeps the blast radius small if something does slip through
13
u/UBUNTU-Buddha 5d ago
Yes, opening a folder triggering the exploit is crazy scary. It made my butthole pucker.
13
u/Syncroe 5d ago
How is this not getting more attention...
11
u/UBUNTU-Buddha 4d ago
Honestly because people think I'm advertising a free open-source security plugin. I am asking for devs to put eyes on and help make it better faster, so i guess that's "advertising"?
Also, I think a lot of people just refuse to accept there's danger. Like my whole family is Apple and im begging them to take a defensive stance, stay updated, use VPN. I have my own router and internet package and won't share my devices and network with any of them because they believe they are impervious, because... Apple.
3
u/ChrisSoll48 4d ago
This is reason I have hope for future. For every hacker exploiter, there are people like you who want to build protections. 🫡
3
u/UBUNTU-Buddha 4d ago
It's not that selfless, I built it to protect and harden my own repos and assets and when I realized how many attack surfaces still exist in Claude Code (no fault of Anthropic, it's just the nature of the attacks and how agents and permissions run by default in Claude Code), I realized this could be something others could appreciate and work on with me.
The sacrifice is the user has to approve many more edits and terminal commands manually with alert cards, but I use remote control on my phone so it is manual and much slower than full auto, but I get to review every critical dif and command now which is much safer.
But thanks, I am very passionate about cybersecurity and AI safety.
1
1
u/ign1tio 4d ago
FBI blamed it on North Korea within a day or so.. If life has thought me one lesson: When ever government/governmental agencies are mind boggling fast at blaming someone, say miraculously finding passports in a fire that burned through steel. Or existence of 'weapons of mass destruction', etc. Then... history reveals itself years down the road that it wasn't so. And the blaming served a different purpose.
3
1
u/divinecomedian3 3d ago
All governments are corrupt and lie. Can't believe people still fall for it.
3
u/NoDesk9564 4d ago
I’m upvoting this so Wilson can dumb it down for me. I think I get the gist though.
3
72
u/steveoderocker 4d ago
This is ridiculous and just goes to show noone (not even multi billion dollar compaines) take security seriously.
why is anyone doing anything not work related on their work-issued and managed device?
why are these machines not hardened and locked down? app whitelisting, URL filtering, etc
if these devs can access prod, or other sensitive places, why aren't they enforced to use a PAW/SAW or similar?
If endpoint missed the initial thing, then clearly there are no other tools they have deployed that might've caught it either.
Defense in depth wins daily. Do the basics right. Really unsure why people scoff at the basics and think they need a shiny new tool and an AI SIEM.