The Binance breach started with a laptop
Binance’s first finding points at one engineer’s laptop. What a device manager can and can’t do about attacks like this one, on Macs and Windows PCs.
Whatever your feelings on cryptocurrency, my sympathy goes out to the almost 8,000 Binance employees, who I know work very hard and are very talented.
On October 29, about $6.3 billion left Binance’s hot wallets in roughly twenty minutes. The full post-mortem isn’t out, and Binance says the attack had more than one point of breach. But its first update pointed at something ordinary: a DevOps engineer’s laptop, which gave the attacker a way into a service that submits withdrawals. Binance says no wallet private keys leaked. The attacker got Binance’s own systems to approve the withdrawals instead.
I build Xavier, a device management platform for Macs, Windows PCs and phones, and laptops like that one are exactly what it manages. So here is what a device manager can and can’t do about an attack like this.
Why the laptop
Attacks like this usually start the same way. A developer is sent a “take-home test” for a job that doesn’t exist, a repository to review, or a package with a familiar-sounding name. Opening it runs a hidden program. The program sets itself up to start at every login, checks in with its owner, and collects whatever the developer can reach: browser sessions, saved passwords, cloud credentials.
Attackers don’t go after developers because developers are careless. They go after them because a developer’s laptop holds the keys to production.
Each step leaves something a device manager can see. Run the attack, then turn on a Xavier control and run it again.
From one laptop to production
Spot what settles in
A hidden program that wants to survive a restart has to register itself, and on a Mac that usually means a LaunchAgent: a small file that tells macOS to start a program at every login.
Xavier’s Mac agent reads every LaunchAgent, LaunchDaemon, Login Item and app background task on every Mac, and checks who signed each program. The Startup Items report lists them across the fleet, rarest first, and flags anything unsigned, ad-hoc signed, in an unusual folder, or named like Apple’s but not signed by Apple. When a Mac reports a startup item that no other Mac in your fleet has, Xavier alerts you in the console, by email, or in Slack or Teams.
Startup Items
LaunchDaemons, LaunchAgents, Login Items and app background tasks across your Macs, rarest first
| Name | Type | Macs | Signed by |
|---|---|---|---|
| com.apple.systemupdate.helperUnsigned · Named like Apple, not signed by Apple | Launch Agent per user | 1 | Unsigned |
| com.docker.helper | Launch Daemon | 23 | Developer ID (9BNSXJN65R) |
| com.microsoft.update.agent | Launch Agent | 97 | Developer ID (UBF8T346G9) |
| us.zoom.ZoomDaemon | Launch Daemon | 141 | Developer ID (BJ4HAAB9B3) |
| com.google.keystone.agent | Launch Agent per user | 148 | Developer ID (EQHXZ8M8AV) |
Try it: tick Needs a look, then open the item.
On Windows, Xavier checks that Defender’s real-time protection and tamper protection are on, and can run a Defender scan from the console. A PC whose antivirus was quietly switched off shows up as noncompliant.
Cut the line home
A hidden program that can’t reach its owner can’t take orders or send anything out. Xavier’s Network filter blocks destinations by name on Macs and PCs. If nobody at your company uses Telegram for work, no laptop needs to reach Telegram’s bot API.
Add a macOS network rule
On devops-mbp-07
The hidden program, SystemUpdate, tries to check in.
Messages that got out: 0
The filter only knows the destinations you give it. It’s for closing off services you don’t use and blocking a bad domain the moment you hear about it, not for recognizing traffic it has never been told about.
Know what’s on a developer’s laptop
Xavier also sees inside the tools developers use:
- Packages. npm, pip, Ruby gems, Homebrew, winget and Chocolatey. Developer packages and Homebrew are checked for known vulnerabilities, with an alert when one turns up.
- Code editor extensions. VS Code, Cursor and Windsurf extensions, on Macs and PCs.
- App blocking. Xavier blocks applications by who signed them, on Macs and PCs, and can close copies already running. That stops remote-access tools nobody asked for. It doesn’t stop an unsigned program it has never seen, which is why the steps above matter.
When it happens, act in minutes
The faster a suspect laptop is out of the picture, the less an attacker gets from it. From a Mac’s page in Xavier you can lock it, erase it or run a script on it. Locking restarts the Mac to a screen that asks for a six-digit PIN, so whatever was running stops and nothing is lost. Windows PCs can be locked and wiped too.
devops-mbp-07
MacBook Pro OnlineTry it: Lock the Mac.
Protect the keys to Xavier, too
A device manager is a skeleton key: an admin who can lock, erase and run scripts on every laptop is exactly who an attacker would like to be. Xavier signs admins in through your identity provider, such as Okta, Microsoft Entra ID or Google Workspace, with roles from your groups. You can require single sign-on so a stolen password alone gets nobody in, keep sessions short, and end someone’s sessions with one click.
Being honest about what this can’t do
Based on what Binance has said, the money left through its own withdrawal systems, which approved something nobody should have been able to approve. No device manager reaches into that; the fixes are on the servers.
Xavier also isn’t an antivirus, and it can’t promise an attacker never gets code onto a laptop. What it does is make every step after that harder, louder and shorter.
A short checklist
- Give the laptops that reach production your strictest settings.
- Look at anything new that starts at login, especially if it’s rare and unsigned.
- Block what you don’t use: unneeded remote-access tools and network destinations.
- Prefer short-lived credentials. A key that expires in an hour is worth little to a thief.
- Open unfamiliar repositories in a throwaway virtual machine, not on the laptop that can reach production.
Xavier is $8 per device per month, the same on every platform, with a 30-day free trial that includes every feature. Try the live demo, or start a trial to see it on your own Macs and PCs.