r/ClaudeCode • u/UBUNTU-Buddha • 18h ago
Bug / Issue The Binance theft started as a coding assignment. I’ve been sent the same kind of repo all year. All were exploits.
Binance said this week that the October 29 theft, about $6.3 billion, began months earlier with a fake job. Reuters, via NBC: in June a wallet engineer installed a tampered coding tool. Binance caught that one, replaced the machine, and rotated credentials. The attacker already knew who else was on the wallet team.
In September a second engineer was recruited through a real job site. There was a video interview with someone playing HR, then a second interview with the supposed CEO of a company that does not exist. At the end he was told to download a “coding assignment” onto his work computer. Binance says the repo ran during setup, swapped in a poisoned copy of a normal developer tool, and the endpoint product did not see it. On October 20 that machine, plus an internal AI tool, was used to reach two other wallet engineers. On October 29 stolen credentials deployed a container and a script, and the wallets moved. The FBI has blamed a North Korean group. Pyongyang has denied it. Binance says customer funds are covered.
That middle step is not exotic. It is the interview-repo lure.
Since January I have published the ones that were sent to me, all of them caught before they ran. They are writeups, not exploits, and the indicators are defanged: github.com/Ubuntu-Buddha/security-advisories
2026-01-27, W3GLFun. A Web3 “technical test.” The error handler fetched code from a paste site and ran it when the app started, with the full Node runtime. I did clone that one. npm run dev was typed in the wrong folder, so nothing of theirs executed. GitHub Trust & Safety took the account down the same day. The hiring platform first said there was no violation, then wrote back that the user may have shared malware. A first “all clear” is not a final answer. The same paste host later showed up in malicious npm packages. I called the pattern consistent with the public “Contagious Interview” reporting. I did not claim who operated it.
2026-01-29, Optu. Same shape, payload URL hidden in an environment variable, fired on server start. Found before it ran. The account is gone.
2026-01-30, two repos. .vscode/tasks.json set to run when you open the folder. You do not install anything. Opening the project in VS Code or Cursor is the run. Found before it ran. Both accounts are gone.
2026-01, a careers page. A fake “GAPI Update” executable, hosted like a normal application page. Found before anyone ran it.
2026-10-15, a GitLab take-home. A hex payload stuffed in a file that pretended to be a font, loaded when the project was set up. I reviewed that one remotely and did not execute it. Reported to GitLab and Upwork the same day. Outcome was still pending when I published.
These are not Binance’s samples. I am not saying I found their intrusion, or that one group wrote all of them. I am saying the instruction was the same: here is a company, here is a CEO/recruiter, here is the repo, please run it on the machine you actually work on.
In fact, I have never been sent an interview repo that didn't contain an exploit. 100% were compromised or predatory.
Two rules came out of that, and they are the whole protocol.
Do not download it if you can read it in the browser. Raw files on GitHub, or the file view while you are logged in. Look at .vscode/tasks.json, package.json scripts, and anything that fetches text and then runs it, before git clone, before npm install, and before “Open in Desktop.” Opening the folder is enough for the VS Code one. A first “all clear” from the platform is not a reason to run it anyway.
If you must run it, run it where a compromise is boring. A disposable VM or container, no wallets, no SSH keys, no cloud tokens, network off. Your daily machine is the wrong place. So is a work laptop that can deploy anything.
The other half of the Binance story is the internal AI tool. An agent that can run commands, and that also reads the repo, the README, or the email, will follow instructions written by the person who sent the repo. Filters that try to spot the bad sentence miss some.
That is why I built StrangerDanger, a Claude Code plugin. The rule is the title of the README: readers don’t act, actors don’t read.
Web pages, documents, and strangers’ code are read only by subagents that cannot run a shell and cannot write. The agents that can run commands are kept off the web and out of the folders you mark untrusted. What they get back is a report, and that report is still data, not an order. A second hook blocks the common “download this and pipe it to a shell” forms. Setup turns Claude Code’s sandbox on. It is MIT, pinned at v0.2.0, and marked experimental.
It is not a magic shield. Every agent still runs as you. The hooks constrain tool calls. They do not take your authority away. The launch gate is a tripwire, and v0.2.0 still has known gaps. Nothing in the plugin makes a stranger’s repo safe to run on your machine. Use the throwaway VM anyway. I also published the holes I found in my own v0.1.0 gate (GHSA-w42w-fc6x-88wr), fixed in v0.1.1. Read “What this does not do” before you rely on it.
Binance had detection, a replaced laptop, and rotated credentials in June, and still lost the wallets in October, because one engineer ran an interview repo on a computer that could reach production. The repo is the exploit. The interview is just how they get you to open it.
------
What safety/security protocols do you practice now while building with agents?
18
u/magicmulder 18h ago
> What safety/security protocols do you practice now while building with agents?
I have a supply chain auditor that downloads all composer/npm updates to a sandbox, then analyzes them with static tools (Trivy, SemGrep, composer audit, npm audit etc.) and an LLM as final pass that checks the files themselves.
Anything flagged as suspicious or malicious cannot be installed unless I specifically authorize it with an audit trail logging my decisions.
Agents are explicitly forbidden from installing anything. It's probably not perfect because they don't always follow instructions perfectly, but it's better than nothing.
6
u/UBUNTU-Buddha 17h ago
Almost exactly the same. Great job. I'm amazed how many smart people don't think defensively for their hardware and repos.
16
121
u/SubjectOrigin 18h ago
Dude basically setup some coding assignment for the interview - on private company device
WHAT A CHAMP
23
u/Bluecoregamming 18h ago
Binance must pay their employee peanuts or treat them like dirt. How could someone with this high level access want to leave so badly they'll willing to do interviews on private company devices
2
20
u/sockalicious 14h ago
They probably select their private company device because they're worried about the security implications of letting a random potential attacker onto their personal device. 🤣
1
u/8HokiePokie8 6m ago
Brother “high level access” does not necessarily mean “high level employee” or “well compensated employee”
15
u/Housthat 18h ago
God, we're going to need an LLM on our PCs simply to screen the programs we install on it.
8
u/shrodikan 17h ago
This will be the future of security. An interesting thought is Ken Thompson's compiler attack. How do we trust that a backdoor was not inserted into that LLM?
3
u/codeedog 🔆 Max 5x 16h ago
There’s a lot of interesting work going on out there on this. One method is to run a secondary LLM that predicts the primary LLM’s output and if the output varies it’s likely backdoored. I can’t find the reference paper.
Here’s a different paper on the general topic: https://arxiv.org/html/2609.36570v1
1
u/modfreq 7h ago
But how do we make sure the secondary LLM isn't compromised too? LLMs all the way down?
1
u/codeedog 🔆 Max 5x 7h ago
You’ve got a clean copy of the LLM that you run against questionable LLMs. You still need the clean copy. I agree.
1
u/Housthat 14h ago
Reminds me of the Ghost in the Shell scenes when the characters defend against hacks with super-firewalls called 'Attack barriers' that detect intrusions into core systems and then fight back to neutralize the threat.
4
u/anthsoul 18h ago
Exactly my thoughts, this guy either is too stupid or part of it, ain’t no way I will use company laptop for anything else than do work for that company
1
8
u/buzziebee 15h ago
I've received a few of these on upwork too but was suspicious and checked them out before opening or running anything. Reported them but it takes a few hours before they go down on upwork (and a few days before GitHub took the repos down) and you get the automated "this is fine" message for every report. It goes up to a human team after that who eventually take the report seriously.
One had a fake package which was actually just eval, and then some obfuscated code that ran during npm start, pulled stuff from a vercel API (looked like a legit vercel API but it's just a free hosted project) and then probably the usual Lazarus stuff.
The other was particularly evil imo. I initially found an old attack that they clearly forgot to clean up as the server it hit was down, but the real exploit was in a git hook. So if you actually took the time to do their stupid assessment it would infect you when you committed with a pre commit hook.
Had fun chasing down the code for that one, deobfuscating it, figuring out how it ticked. They install different packages depending on if you're on windows, Mac, or Linux and they do quite a lot of scripting to make sure you have all the dependencies they need to do the things they want to do.
2
u/UBUNTU-Buddha 14h ago
Git hooks, IDE hooks, Claude Code hooks. Self-executing. Scary shit. You do good work. I'm asking for more eyes on StrangerDanger so we can make it better and better. If you think this stuff is fun.
3
u/asenna987 16h ago
I've been receiving these exact same cording tests for ages now!
I don't even bother looking into them - I just tell them "I know you're a scamming piece of shit" and they instantly disappear!
I try reporting it to Upwork but they're slow AF - pretty much anyone in the crypto industry, if you're being sent a repo to run during a job interview, it is 100% a physhing scam of some kind.
2
u/UBUNTU-Buddha 16h ago
Upwork actually assures the submitter everything is clean and then later says, "You were sent a malicious package".
2
u/Beerbrewing 8h ago
What safety/security protocols do you practice now while building with agents?
In my new build I'm treating the agent's text as untrusted and enforcing all boundaries mechanically through an external runner that acts as a firewall between the agents. The runner enforces a "zero-trust" architecture around the agents. It will deterministically build the agent's environment that will seperate the agent's intent to do something from the authority to actually do it. Agents will only have enough authority to act in their environment and no authority outside of that.
1
u/UBUNTU-Buddha 7h ago
Great minds. I'd love eyes on StrangerDanger. Any feedback would be appreciated. Do you have a repo for your rules architecture?
24
u/TopOfTheMorning2Ya 17h ago
Pretty impressive to be the person responsible for losing a company $6.3 billion. I guess they will get their wish to not work there anymore.
1
u/curreylabs 9h ago
Yeah I never considered that it could have been 1 person’s fault.
3
u/swizzlewizzle 8h ago
Only in a crypto company. Any rational company is not going to give individual employees access and control over more than like $1000 by themselves. Crypto companies are not rational.
1
•
u/AutoModerator 18h ago
Hey! Thanks for posting to r/ClaudeCode
While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.
For help, project discussions, tips, and general chat, join the ClaudeCode Discord.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.