Dodgy download and spoofed job ad led to $6.3 billion Binance hack: attacker offered fake software and fake job to infiltrate company wallets and steal billions

A chain of events that led to a record-breaking $6.3 billion mega-hack began with a dodgy download, so says the company that was hacked, Binance.

The world's largest cryptocurrency exchange says that the hack was not a "single isolated breach or simple phishing incident"; multiple steps were required to break through its security measures. It all began when a Wallet DevOps engineer (named Engineer A) downloaded a tampered Homebrew installation that was suggested to them by an unnamed search engine.

Homebrew is a third-party package manager for macOS. A report from the SANS Technology Institute, linked to in Binance's investigation, suggests that malicious adverts for Homebrew have been spotted in search engine results, hoping to ensnare users into installing malware on a user's PC.

"Our security team detected the anomaly, replaced the device, and rotated all related credentials as a proactive security action," Binance says. "However, Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker."

https://t.co/sU9dUqLQDHNovember 3, 2026

Then came a separate incident with a software engineer (named Engineer B). They were contacted through a job hunting platform (Binance says it was a legitimate platform) and was asked to attend a first-round interview with a HR representative. This was followed by up a second-round interview with the CEO. Not the HR representative, nor the CEO, however, were real; the company was made up.

The aim of the interviews? To offer Engineer B an 'assignment' that was really a repository of malicious code that executed during setup. The malware ran a series of commands and evasion techniques to avoid detection, thus avoiding Binance's security checks.

The attacker used Engineer B's now-compromised computer and an internal AI tool to gain control over two further machines: that of Engineer A and another Wallet Software engineer (Engineer C). They discovered a container deployment permission token on Engineer A's machine. With this, they could log into Engineer C's computer using the stolen credentials to create a container and trigger a malicious script to start the mega-hack that would drain $6.3 billion worth of funds from wallets used to store transitory funds by the exchange.

So, basically, the internet is a bad place, and you can't trust anyone. Or, at least, you have to have your wits about you—especially if you happen to have the key to a multi-billion dollar company's finances stored on your PC somewhere. Luckily, my PC is just pictures of my cat and a Steam backlog that won't quit.

That's actually some of the criticism levelled at the company. Should it have been possible to get this level of access even with spoofed ads and jobs?

TLDR: If DPRK are reading this, they should be saying "time for round 2".Takeaways:- critical infra engineers are free to download arbitrary software on work laptops.- the day-to-day work setup can connect to billion dollar signing environments.- no human oversight or physical confirmation for moving 10-figs of value / EIP-7702 code change.- various AI vibe-based tools running in corp environments doing god knows what except serving as a remote compromise surface, framed as a good thing btw.- none of the above labelled as the problem. - instead, reads as blaming employees for falling for social engineering, and anti-virus not catching the malware. This is a dog-ate-my-homework level excuse deployed after a nuclear-failure level event.Sincerely hoping binance have more reloads available to cover the next losses too. Reaching exchange hot wallets will never be near impossible, but it should not be this easy either.November 3, 2026

Reminder that the FBI reckons a North Korean hacking group is behind the attack, which North Korean officials have unsurprisingly denied. Binance has frozen roughly half of the funds that were initially stolen, and has already covered the rest.