# Infostealer Logs Expose Binance Corporate Identities Linked to Okta, Kibana, Git and JetBrains Access

> Flare Research analyzed 219 stealer logs (Feb 2022 - Oct 2026) containing 74 distinct @binance.com usernames and 58,846 nested records (credentials, cookies, files). Corporate identities appeared alongside developer and monitoring tools, including one identity across Okta, Kibana, Git and JetBrains, indicating device compromise, credential theft and session token exfiltration risk.

- **Published:** 2026-10-30T22:39:44Z
- **Last reviewed:** 2026-10-30T22:39:44Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4861
- **ID:** TL-2026-4861
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-30 Flare Research (Assaf Morag) published an analysis of historical infostealer logs that match the Binance corporate domain, written in the context of the Binance security incident disclosed 2026-10-29/30. The dataset comprises 219 stealer logs spanning February 2022 to October 2026, holding 74 distinct @binance.com usernames and 58,846 nested records (credentials, cookies, files and authentication artifacts). Three views were reported: binance.com URL with any username (407 credential records, 187 logs, 87 usernames); binance.com URL plus an @binance.com username (22 records, 22 logs, 7 usernames); and any @binance.com username across all destinations (356 records, 219 logs, 74 usernames).

Focusing on 168 credential records covering 35 distinct @binance.com usernames in 49 log entries, the identities were associated with: Kibana (51 records, 3 logs, 15 usernames, 16 username-host pairs), Binance Okta tenants (49 records, 29 logs, 15 usernames, 18 pairs), LastPass (22 records, 11 logs, 1 username, 1 pair), Google identity (20 records, 13 logs, 7 usernames), private-network IPs (9 records, 3 logs), JetBrains (6 records, 3 logs, 1 username), Microsoft identity (5 records, 5 logs), Git (3 records, 3 logs, 1 username) and an AWS load balancer (3 records, 3 logs). One identity appeared across Okta, Kibana, Git and JetBrains, illustrating how a single compromised endpoint can link corporate sign-in with development and monitoring tooling. The 22 LastPass records collapse to one username-host pair, so raw counts overstate exposure. One repeated collection contained 16 distinct @binance.com usernames.

Important caveats from the source: the findings do not establish that the credentials are valid, that the usernames belong to employees, or that the logs are connected to the Binance incident. The source names no malware family, threat actor, CVE or IOC. For context, public reporting (CyberInsider, HackRead) states the Binance incident (about 2026-10-29 20:05 GMT) had an estimated $6.3B impact with roughly $3B frozen, that a compromised DevOps engineer's laptop was an entry point to a service container used to submit unauthorized withdrawals, that no wallet private keys were reported compromised, and that TRM Labs and Chainalysis attributed the incident to TraderTraitor (DPRK-linked). That attribution applies to the incident, not to the stealer logs analyzed by Flare, and no link between the two is established, so this record leaves actor attribution as Unknown.

Defender relevance: stealer logs carry session cookies and tokens, so a password reset alone does not invalidate stolen sessions. Flare recommends validating exposure (identity, services, record dates, credential types), reviewing authentication logs for unauthorized access, isolating the affected endpoint, revoking sessions and refreshing tokens, resetting credentials and rotating exposed secrets, limiting persistent privileges, enforcing phishing-resistant MFA and requiring extra authorization for sensitive actions. Flare also reports processing over 1 million stealer logs per week with a minimum of about 1% containing corporate IT access.

## MITRE ATT&CK

- T1555.003 Credentials from Web Browsers
- T1555.005 Password Managers
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1552.001 Credentials In Files
- T1005 Data from Local System
- T1213.003 Code Repositories
- T1078 Valid Accounts
- T1550.004 Web Session Cookie
- T1657 Financial Theft

## Sources

- [Beyond the Binance Attack: How Stealer Logs Can Link Corporate Sign-Ins to Developer and Monitoring Tools (Flare, Assaf Morag)](https://flare.io/learn/resources/blog/binance-attack-stealer-logs)
- [Binance links $6.3 billion security incident to compromised laptop (CyberInsider)](https://cyberinsider.com/binance-security-incident-6-3-billion/)
- [Binance Probes DevOps Engineer's Hacked Laptop After $6.3B Theft (HackRead)](https://hackread.com/binance-devops-engineer-hacked-laptop-billion-theft/)
- [Binance Says DevOps Laptop May Have Been the Entry Point in $6.3bn Incident (Disruption Banking)](https://www.disruptionbanking.com/2026/10/30/binance-says-devops-laptop-may-have-been-the-entry-point-in-6-3bn-incident/)
- [Binance freezes $3B after security incident, suspends withdrawals (Fox Business)](https://www.foxbusiness.com/technology/binance-says-security-incident-had-estimated-6-3b-impact-3b-assets-frozen)
- [$6.3 billion Binance hack is largest crypto theft on record (CNBC)](https://www.cnbc.com/2026/10/29/circle-tether-freeze-funds-impacted-by-potential-binance-security-issue.html)
- [Dissecting the Dark Web Supply Chain: Stealer Logs in Context (BleepingComputer, sponsored by Flare)](https://www.bleepingcomputer.com/news/security/dissecting-the-dark-web-supply-chain-stealer-logs-in-context/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4861