Binance's $6.3B hack was not a code bug, analysts argue, pointing to signing authority

·2 views

Reports from October 29–30, 2026 describe a theft of roughly $6.3–6.4 billion, which TRM Labs attributes to North Korea and which several outlets tie to an EIP-7702 update. Some of these outlets, however, suggest the update may have amplified losses rather than caused the breach, with one estimate stating most of the funds were taken without it. The author argues the relevant question is who could sign transactions, not which code primitive failed, framing the incident as a problem of authority chains in deployment systems. To illustrate, the author audited their own public repository's GitHub Actions workflow, finding overly broad write permissions inherited by all jobs and floating tag references. After reducing permissions and splitting the workflow into separate build and deploy jobs, the findings dropped from eight to three.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Agent loops need runtime controls: budgets, deadlines, cancellation, and idempotency

The article argues that production failures in AI agents usually stem from the execution loop rather than model quality, such as runs that spin for long periods, duplicated side effects, or cancellations that fail to stop workers. It recommends treating the loop as a runtime with admission control, deadlines, cooperative cancellation, and at-most-once side effects. Agent runs should have separate limits on steps, wall-clock time, tool calls, and cumulative tokens or cost, since per-step costs rise as conversation history grows. Cancellation must also reach inside tool calls through propagated deadlines and explicit timeouts on every blocking operation. Finally, retried writes should be prevented with deterministic idempotency keys stored alongside the effect, and third-party APIs without idempotency support should use an outbox-style record-and-reconcile approach.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Zoho Founder Says One AI-Equipped Worker Could Match Ten, Warns of Faster Job Losses

Sridhar Vembu, founder and chief scientist of Zoho, warned in an October 29 post on X that one skilled worker using AI could perform the work of ten. He said the risk of job losses in computer-based office work is becoming more real as AI tools improve. Vembu did not forecast that 90% of jobs will disappear, but argued that reduced labor needs could arrive faster than new job creation. He acknowledged that cheaper work could eventually lower prices and spawn new businesses, but said the timing gap could hit wages, hiring and entry-level roles first.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A No-Login Workflow for Researching Public TikTok Content

The article argues that TikTok research for marketers, creators, and researchers is often hampered by forced logins, autoplay, and recommendation feeds that encourage endless scrolling. It proposes a focused approach built around a specific question, using a no-login viewer to review public profiles, recent posts, and comments. The author, who built the tool GlimTok, describes features such as on-demand loading, no autoplay, and private bookmarking, while cautioning that public-only access, possible data lag, and the research-not-tracking principle still apply. The piece recommends ending each session with a short written summary of what was viewed, learned, and planned next. The article is disclosed as promotional content from the tool's maker, who states the tool is independent of TikTok and ByteDance.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Lessons from building and marketing a crypto tipping platform for creators

A developer building BuyMePizza, a crypto tipping platform, discovered that finishing the product was only the first challenge. Attracting users proved harder than building the technology, as early site traffic failed to convert into signups. The founder found that visitors were often outside the target audience, since technology enthusiasts did not necessarily need a tipping service. Instead, the lesson was to seek out creators, streamers, and open-source developers who already face the problem the product solves. The article shares seven lessons on distribution, audience fit, and focusing on user needs rather than features.

0 comments Read more at DEV Community