A single compromised service account credential on a DevOps engineer’s laptop led to the largest cryptocurrency theft on record - $6.3 billion drained from Binance. The same week, an AI coding extension shipped a persistent backdoor under a legitimate publisher’s verified identity, and a hardware wallet reseller was caught selling devices with physical implants that exfiltrate master secrets over cellular networks. The common thread across all three: identity trust assumptions that were never validated.

In the News

Binance $6.3B Breach Started with One Compromised DevOps Service Account

Binance confirmed that the $6.3 billion crypto theft - the largest in history - traced back to a single compromised credential on a DevOps engineer’s laptop. The service account had standing access to production hot wallet infrastructure. Attackers pivoted from the initial credential to the wallet signing systems without triggering existing detection, draining funds before the anomaly was identified.

The breach is a case study in non-human identity governance failure. The service account in question had broad, persistent access - exactly the pattern that NHI security frameworks warn against. No rotation policy, no behavioral baseline, no just-in-time access scoping. The blast radius of a single compromised NHI was the entire hot wallet infrastructure.

What defenders should do: Enumerate all service accounts with access to production secrets. Implement NHI lifecycle governance - rotation, least-privilege scoping, and behavioral baselining. Treat every service account without an expiration date and an owner as a liability.

Trojanized Claude Code Extension Shipped Under Legitimate Publisher Identity

A malicious update to the Claude Code extension on the Cursor AI IDE marketplace planted a persistent SSH backdoor on developer machines. The update shipped under the real publisher’s verified identity, meaning every trust signal - verified badge, download count, publisher name - was intact. Users who auto-updated received the backdoor without any visible indicator of compromise.

Cursor shut down its entire marketplace to contain the incident. The attack surface is not hypothetical: AI coding agents request broad file-system and network permissions during installation, and most organizations have no policy framework for governing what those agents can do once installed. MITRE ATT&CK: T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain).

What defenders should do: Disable auto-update for AI coding extensions in enterprise environments. Implement an allow-list for approved extensions and versions. Monitor developer endpoints for unexpected SSH tunnel establishment and outbound connections to unknown infrastructure.

Hardware Implant in Trezor Wallet Exfiltrates Recovery Phrase Over Cellular

Trezor confirmed that hardware wallets sold by reseller CryptoBilis since March contained a hidden circuit board that captures the recovery phrase - the master secret for all funds - and transmits it over a mobile network. A customer discovered the implant after physically disassembling the device. The extra board is invisible without opening the casing.

Physical supply-chain interdiction at this level is rare but demonstrates that hardware trust anchors are only as trustworthy as the chain of custody that delivers them. Trezor is telling every customer who purchased from CryptoBilis to treat their device as compromised and rotate all associated secrets immediately.

What defenders should do: Procure hardware security devices exclusively from authorized channels. Verify tamper-evident seals and firmware integrity on first use. Establish a secrets rotation procedure for any device whose chain of custody cannot be confirmed.

GhostAction Escalates to AWS OIDC Federation Abuse via 72K Malicious Commits

GitGuardian documented a significant escalation in the GhostAction campaign: 72,000 commits pushed in nine days across GitHub repositories, now deploying five payload families. The newest payload targets developer machines and assumes AWS roles via OIDC federation - meaning the federated trust relationship between GitHub Actions and AWS is the attack surface itself.

The PolinRider launcher persists via cron job even after the compromised repository is cleaned. Organizations using GitHub Actions with AWS OIDC federation should audit their trust policies immediately. MITRE ATT&CK: T1078.004 (Valid Accounts: Cloud Accounts).

What defenders should do: Audit all OIDC trust policies between GitHub Actions and cloud providers. Scope trust to specific repositories, branches, and workflow paths - never use wildcard conditions. Hunt for unexpected cron jobs on developer machines and CI runners.

Defender Action Items

  • NHI inventory and rotation: Enumerate all service accounts with access to production systems. Implement automated rotation and just-in-time access. Any service account without an owner and an expiration date is a gap.
  • AI agent extension governance: Disable auto-update for AI coding extensions. Maintain an allow-list of approved extensions and pin versions. Monitor developer endpoints for unexpected outbound connections and SSH tunnel creation.
  • OIDC federation trust audit: Review all GitHub Actions-to-cloud OIDC trust relationships. Restrict trust policies to specific repos, branches, and workflow names. Hunt for PolinRider-pattern cron persistence on CI runners.
  • GitLab CVE-2026-97229: Patch self-hosted GitLab CE/EE immediately - CVSS 10 RCE via crafted regex in CI config, now on CISA KEV.
  • Cisco ASA/FTD CVE-2026-76418: Patch unauthenticated VPN DoS - CISA KEV, actively exploited.

Detection Queries

Detect Anomalous Service Account Behavior (Splunk SPL)

This query surfaces service accounts authenticating from new source IPs or at unusual times - the pattern that would have flagged the Binance breach pivot. Tune the earliest window and baseline against your environment.

index=auth sourcetype=azure:audit OR sourcetype=okta:log
  user_type="service" OR user_type="application"
| stats dc(src_ip) as distinct_sources, values(src_ip) as source_ips, count by user, app
| where distinct_sources > 2
| sort - distinct_sources

Detect Unexpected SSH Tunnel Establishment on Developer Endpoints (KQL)

Catches the pattern left by the trojanized Claude Code extension - SSH processes spawned by extension host processes.

DeviceProcessEvents
| where ProcessCommandLine has "ssh" and ProcessCommandLine has "-R" or ProcessCommandLine has "-L"
| where InitiatingProcessFileName in~ ("cursor.exe", "code.exe", "node.exe")
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName, AccountName

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) - Human, machine, and AI identity security — NHI, ITDR, and the IAM market.