Binance has revealed the full, multi-phase strategy behind last week’s $6.3 billion crypto heist—long held as the largest in history—highlighting how attackers used Mac-targeted malware and deceptive job interview tactics to break into the exchange’s wallet infrastructure. What began in June with a poisoned software installer escalated into a sophisticated zero-day campaign culminating in a massive transfer of funds from hot wallets. As investigations continue, the lessons extend far beyond Binance.
Attack Chain: From poisoned Homebrew to wallet signing breach
The first breach allegedly occurred in **June 2026**, when a DevOps engineer at Binance’s Wallet team downloaded a malicious version of Homebrew while trying to install an AI coding tool. This trojanized installer planted malware in `/opt/homebrew`—the path used on Apple silicon Macs—exposing key details about the engineer’s role and his colleagues before detection kicked in. Although Binance claims it replaced the device and rotated credentials, the disclosure already gave attackers insight into who to target next.
In **September**, attackers staged a fake recruitment drive. Another engineer was approached through a legitimate job portal by actors posing as HR, a project director, and even the CEO. After trust was built, the engineer was asked to install a coding “assignment” on his work machine. The package was laced with malware that swapped out a critical developer tool—`pyenv`—with a malicious version. Security tools missed this zero-day component, which included evasion measures and command-and-control capabilities.
By **October 20**, attackers used the compromised engineer’s laptop and an internal AI tool to extend access into the wallets team. Two additional engineers—one with a container deployment permission token—were compromised. Then on **October 29**, with stolen credentials and the token, they launched a container-based attack that tapped into Binance’s wallet signing service. Exploiting Ethereum’s EIP-7702 mechanism allowed attackers to bundle authorization across transactions, enabling transfers outside normal withdrawal limits.
Aftermath and current status
Binance froze or intercepted approximately **$2.85 billion** of the stolen assets, and reports indicate about **98% of impacted token holdings** have been replenished using company resources. The firm reports that **57 suspected North Korea-linked cyber threat campaigns** were thwarted earlier in the year using similar tactics. The FBI has attributed the attack to a North Korean state-sponsored group, with authorities and third-party cybersecurity experts brought in to analyze the damage and recommend safeguards.
Binance has taken significant remediation steps: compromised devices and credentials have been replaced; the affected wallet systems and internal AI tools rebuilt; and additional controls deployed across developer environments, endpoint detection systems, and behavior monitoring.
All this started with what, to many would appear as ordinary developer work: a software search, a coding test, installing normal-sounding tools. There was no outstanding zero-day exploit on the OS level—attackers leaned heavily on **social engineering**, poisoned supply chains, and internal tool abuse.
Given how details leaked from the very first breach in June (before detection), it’s clear that even when a threat is identified fairly quickly, the damage from exposure of role, team structure, and internal systems can provide an irreplaceable roadmap for attackers. As organizations race to shore up AI tools and internal access, this incident shows that attacker sophistication now often comes not from novel exploits but from well-orchestrated, blending of classic social tactics with developer workflows.
