1 year ago
Changpeng Zhao (CZ), the CEO of Binance, has addressed concerns surrounding the probe into “abnormal terms movements” for immoderate trading pairs connected the exchange.
Based connected our investigations truthful far, this appears to beryllium conscionable marketplace behavior. One feline deposited funds and started buying. (Hackers don’t deposit). Other guys followed. Can’t spot linkage betwixt the accounts. 1/3 https://t.co/QlB1VnlHVs
— CZ 
Binance (@cz_binance) December 11, 2022
CZ reported that the steadfast had temporarily locked withdrawals for “some of the profiting accounts” that had caused complaints connected societal media.
In a statement, CZ said:
“We are alert of the conception of excessively overmuch involution from the platform, “too centralized” attacks, etc. There is simply a equilibrium to however overmuch we should intervene. Sometimes, these hap successful escaped market, and we request to fto it play out.”
Binance’s authoritative Twitter relationship announced that the suspicious enactment that sparked interest connected societal media did not look to beryllium caused by hacked accounts oregon stolen API keys and that funds are “SAFU.”
This enactment does not look to beryllium owed to compromised accounts oregon stolen API keys; funds are SAFU.
We volition update this thread should determination beryllium immoderate caller information.
— Binance (@binance) December 11, 2022
However, CoinMamba, a futures trader and crypto investor, revealed a antithetic position connected the concern erstwhile they declared connected Dec. 8 that their Binance relationship was hacked done an API created 2 years ago, submitted exclusively to 3Commas, a crypto trading bundle provider.
The API was lone submitted to 3Commas and obscurity else, which I haven’t utilized since creating an relationship there. If you person likewise submitted your API there, you should instantly delete them from your Binance account.
— CoinMamba (@coinmamba) December 8, 2022
CZ responded to CoinMamba, explaining that Binance had “seen aggregate cases related to 3Commas,” and claims that users were phished.
I haven’t utilized 3Commas for astir 2 years and didn’t adjacent retrieve I had an relationship there. This is decidedly not a phishing case.
Also I didn’t person an IP whitelist for my API keys but for immoderate crushed they were kept active. They should’ve been disabled by you.
— CoinMamba (@coinmamba) December 9, 2022
Phishing attacks person been an ongoing theme, arsenic seen successful Oct. connected exchanges similar FTX and Binance, wherever users fell prey to phishing attacks targeting crypto services similar 3Commas.
Though CoinMamba discarded the thought of this being a phishing case, 3Commas provided a full probe blog post of the API cardinal attacks connected Dec. 10, describing the modern improvement of ‘phishing.’
“Over time, phishing has evolved to incorporated caller onslaught vectors, specified arsenic paying to advertise imitation websites precocious successful hunt motor rankings oregon to incorporated malware arsenic portion of the attack. Also, phishing has been known to people circumstantial groups of people, precocious net-worth individuals oregon adjacent companies (known arsenic “Spear phishing” oregon “Whale phishing”)”
Despite the investigative station by 3Commas, concerns surrounding stolen API keys lone grew arsenic much Twitter users revealed losses and described 3Commas arsenic “NOT Safe.”
On 12/6/22, A 3Commas API (Free Account) I setup implicit 2 Years agone and forgot astir abruptly became progressive and began performing unauthorized trades connected my Binance Account:
– $155K Losses (Contra-Traded)
3Commas failed to support lawsuit API data. 3Commas is NOT Safe: pic.twitter.com/KkhVwVM9YA
— Joel (@akng1985) December 7, 2022
Even on-chain Sleuth, ZachXBT, weighed successful connected the discussion:
And 3Commas is inactive claiming radical were conscionable “phished” lol pic.twitter.com/Ka7HI53oAL
— ZachXBT (@zachxbt) December 8, 2022
With surmounting grounds confirming stolen API keys astatine 3Commas, nonaccomplishment of funds by aggregate users, and existent API information vulnerability, it is doubtful that funds are “SAFU.”
Following a Twitter statement betwixt CoinMamba and CZ to its conclusion, a deleted remark by CZ revealed retaliatory comments suggesting the “offboarding” of some 3Commas and CoinMamba’s Binance accounts.
Tweet deleted. But CT remembers.. pic.twitter.com/p5nkeDmhe1
— CoinMamba (@coinmamba) December 9, 2022
On Dec. 9, CoinMamba’s declared that their Binance relationship had been closed and received an explanatory effect from Binance’s Customer Support Twitter account.
Your relationship was placed into withdrawal lone mode. The determination was successful effect to threats you made to our CS, not related to our Twitter dialogue. We pulled unneurotic a squad of implicit 20 lawsuit agents to effort and assistance you. We are atrocious it has travel to this, but privation you each the best. pic.twitter.com/lTkKy2WnJS
— Binance Customer Support (@BinanceHelpDesk) December 9, 2022
The station CZ addresses concerns implicit probe into ‘abnormal terms movements’ connected Binance appeared archetypal connected CryptoSlate.
English (US) 