Most exchanges don't use a single wallet per user, but have a small pool of wallets that all their customers share, and they just do the bookkeeping of the balances of each account. That lets them group many transactions together into a single larger transaction, or avoid a transaction entirely if it's between two users on their exchange.

So that pool of wallets that stores all their customers funds needs to be managed by the exchange somehow, meaning there's going to be some sysadmins/devs/etc that have access to parts of the system that deal with those wallets, and possibly also the keys to those wallets (which it looks like was the case here).

It's unlikely an engineer would have direct access to anything. That should be at least behind multisig. But you never know, people do dumb shit and there might have been critical private keys mounted in some random container from a subsystem made 6 years ago that was never replaced or tracked because it never made noise.

I don't work at Binance, but having been in that exact situation (SRE @ Crypto company with lots of assets, attacked by North Koreans), I'm guessing DevOps guy gave access to some CI/CD, `kubectl exec` what have you which allowed attackers to play with APIs, some settlement mechanic, some smart contract update pipeline. You don't really have to attack wallets if something less secure controls them. This really could stem from nothing, excessive permissions in a GitHub token can go very leveraged properly.

It's so crazy. As a user, you need to triple authenticate with all sorts of gates to withdraw money but here's a dev guy who can just magically, without any secondary authorizations (as far as I can tell), transfer billions. No devops/sys admin should have access to live wallets with real funds

1) The coins belonged to customers, but were in Binance wallets (thus under control of Binance) - that's how exchanges work. You send them your coins, then you can trade.

2) You can't freeze Bitcoin transactions (well, the crypto bros running it could if their majority wanted to, but they don't want to), but some of the stolen coins were stablecoins like USDT and USDC.

And fiat-backed stablecoins are ipso facto centralised (someone needs to 1) take receipt of fiat and issue coins against that, 2) custody that fiat and hold on to it reliably, and 3) return the fiat when given back the coins). You can then with the private key send the coins back to the issuer, but the issuer can refuse to give you the fiat.

However, many stable coin smart contracts are even more powerful: they give the issuer an authorized control account that can add a wallet address to a blacklist. The contract checks that list whenever someone tries to move the token; if the address is blocked, it rejects the transfer. Then the balance can’t be moved.

There’s a small difference: USDC blocks transfers both to and from a blacklisted address. USDT generally blocks the address from sending USDT, though it may still receive USDT. Tether’s contract also has a separate function that can destroy tokens held at a blacklisted address; that is distinct from simply freezing them. Note that when they destroy tokens, Tether keeps the cash - so it's a transfer from the criminals (or whoever held the tokens) to Tether. (Tether can then re-issue the coins and hand them back to law enforcement or the victim, but that's a separate step.)

It's probably less that he had "access" and more like it maintained some underlying systems.