I used to be the goal of a cybercrime on 10/17 round 3am CT. A hacker obtained entry to API credentials on my Binance.US account and executed a number of trades on extremely illiquid alt cash to revenue on the opposite facet. My account was drained of $125,000 this fashion in a matter of hours. I had Google 2FA, IP handle whitelisting, a novel password, by no means click on on electronic mail hyperlinks and solely go on to Binance.US when logging in.
I created a learn solely API on Binance in February 2022 for Zen Ledger for tax reporting causes. One chance is that I unintentionally created the API key with commerce entry AND somebody hacked Binance or Zen Ledger to get the API public and secret key. The key key just isn’t seen on the Binance portal even when somebody had my credentials. It was by no means shared since then and I didn’t reserve it on any gadgets. In both case, even when I did create the API with commerce credentials, Binance documentation states that commerce permissions ought to mechanically be disabled after 30 days: https://www.binance.com/en/assist/announcement/updates-to-api-key-permission-rules-2021-07-08-cda0a4b53da04396b5d27881e93abf78
If the hacker had my credentials and was in a position to bypass 2FA via cookie hijacking, it’s only potential to create a brand new API with 2FA, which I’ve enabled on my account. 2FA is required upon creating a brand new API key.
One other chance is that somebody hacked the Binance API bridge immediately. The worst case is that this was an inside job. I don’t wish to suppose that it’s, however I wish to listing all choices I can consider for transparency.
Binance suspended my account whereas they investigated. Their solely conclusion is that the hack occurred via an API. They refuse to supply different particulars and are denying accountability. They stated they might cooperate with the authorities and informed me to consult with their phrases of service concerning my accountability for safety of my account. I had all safety measures enabled.
I’ve reached out to authorized counsel and was suggested that I attain out to the Secret Service Cybercrimes division, Legal professional Normal and file an area police and IC3 report. I’ve accomplished this and at the moment ready for responses. I’ll publish updates to this thread as I’m going.
