SlowMist founder says Binance theft should be viewed as an APT attack, not just a social engineering lapse

SlowMist founder Yu Xian said on X that many people who reviewed Binance’s disclosed account of the theft concluded the engineer involved had made a basic mistake and held excessive permissions. Yu argued that this framing is too narrow. He said the incident fits the pattern of an advanced persistent threat, or APT, rather than a case that can be explained only by the initial social engineering stage. According to his post, such attacks can span multiple layers, including exploitation of human behavior, intelligence gathering, malware evasion, abuse of trust relationships, targeted lateral poisoning, cloud environment penetration, risk-control bypasses, and 0day vulnerabilities. His comments focused on the complexity of the attack chain described around the Binance case and pushed back on attempts to reduce the event to a single operational error. The remarks were cited by ChainCatcher in a 7x24 news update.