Member-only story
What the Binance $40M Hack Teaches DevOps About API Keys and Secrets
In 2019, attackers took 7,000 bitcoin from Binance without breaking any encryption. They used real API keys and real 2FA codes. Here is what that teaches every DevOps team about secrets.
Before publishing: this is an analysis based on public reporting. If you can, add a sentence or two from your own experience with secrets management or key rotation. Remove this note and the publishing kit at the end.
We like to imagine hacks as someone breaking through a wall. The Binance hack of 2019 was not like that.
The attackers walked through the front door with valid credentials. To Binance’s systems, every request looked like it came from a real user, because it was signed with a real user’s key.
That is the uncomfortable truth about API keys, tokens and passwords. A secret does not know who is holding it. Whoever has it is, as far as your system can tell, the owner.
This article walks through what happened, why valid credentials are so hard to defend against, and seven practices DevOps teams can use to make stolen secrets far less useful. It ends with how last week’s much larger Binance hack shows the same lesson…
