‘Double Check Your Keys’: CZ Binance Tells Crypto Developers Following GitHub Security Incident

Binance cofounder Changpeng “CZ” Zhao warned crypto developers in a recent tweet after GitHub said in an X post that it is investigating unauthorized access to some of its internal repositories.

Responding to this information, CZ urged developers to act accordingly regarding the safety of their repositories. For those who have API keys in their code, CZ stated that there could be no better time than now to double-check and change them. This also applies to private repositories.

“If you have API keys in your code, even private repos, now is the time to double-check and change them,” CZ wrote.

API keys are used by developers to connect applications with exchanges, wallets, cloud services, AI tools, databases, and payment systems. In the cryptocurrency space, exposed API credentials can be dangerous as they could give access to trading systems, withdrawals, backend infrastructure, or sensitive user data. As indicated by CZ, even private repositories may not be immune to such risk.

What happened?

In a recent tweet, GitHub confirmed a security breach, saying it was investigating unauthorized access to its internal repositories. GitHub says it currently has no evidence of impact to customer information stored outside of its internal repositories (such as its customers’ enterprises, organizations, and repositories), but it is closely monitoring its infrastructure for follow-on activity.

In a separate tweet, GitHub shared additional details regarding its investigation into unauthorized access to its internal repositories.

Yesterday, a compromise of an employee device involving a poisoned VS Code extension was detected and contained. The malicious extension version was removed, the endpoint isolated, and incident response began immediately.

The current assessment indicates that the activity involved exfiltration of GitHub-internal repositories only. The investigation indicated 3,800 repositories were affected in this regard. In a swift move to curtail risk, critical secrets were rotated, with the highest-impact credentials prioritized first.