Technology

There’s something sort of poetic in an engineer working for a massive crypto company, probably already very well paid, shirking his ethics to use his company laptop to apply for another job, and then opening them up to a breach. Breed a culture of selfishness, get pwned by a more progressively selfish system.

Remember the founder of Binance:

He resigned as the CEO of Binance in November 2023 after the U.S Department of Justice alleged he violated the Bank Secrecy Act and the International Emergency Economic Powers Act.[2][3] He pleaded guilty and was sentenced to four months in prison in April 2024.[3][4] Zhao completed his sentence by September of the same year.[5] In October 2025, Zhao was given a presidential pardon by President Donald Trump.[6]

Zero sympathy for anyone involved, got what was coming

Really interesting way to have socially engineered the access

I'm sorry who applies for a job on their corporate laptop? Apart from the fact that no one should be downloading anything onto a corporate device that isn't sanctioned you have no idea how monitored the device is. If you apply for a job and then you don't get it you don't want your current company knowing that you're looking to leave.

The most rudimentary of operational security would have prevented this. How fitting that it's a crypto company.

1. Scary to hear that it all started with someone trying to download Homebrew, but at the same time who the fuck clicks on Google ads when looking for development tools?
2. I wish they would have given more details about how the hackers managed to spread from the second dev's machine into the third and fourth's, which they actually used in the end.

The June part is what stuck out to me. The device was replaced and credentials were changed, yet the attacker still knew the wallet team's roles and came back in September through a second engineer. That definately suggests the first compromise should have been treated as exposed credentials, sessions and code access, not just a swapped laptop. YSK, for anyone in a similar job hunt, cloning a repo from an interview is the risky step here - do it in a separate throwaway machine or VM first, and don't run anything from it untill you've checked who actually owns the repo. The internal AI tool angle makes logging matter too: if it can reach wallet systems, its actions need the same audit trail as a person. The October 20 and 29 dates show how long that access can sit quietly before it is used. Hope that helps.