Binance says the attack that drained $6.3 billion from its wallets began with a fake Homebrew installer that an engineer found through a search engine, according to 9to5Mac's Security Bite column. No zero-day was involved. If you install developer tools by searching for them, or you run code that strangers send you, this attack path applies to you.
What Binance says happened
The world learned of the theft on October 29, and Binance published a more detailed breakdown on November 3, 9to5Mac reports. You can read Binance's own post here.
By Binance's account, as summarized by 9to5Mac, the attack came in two phases:
- June 2026. A DevOps engineer on the Wallet team searched for an AI coding tool and downloaded a malicious clone of the Homebrew installer found via Google Search. Binance says it caught this early and stopped any damage, but the attackers learned which employees worked on wallets.
- September. A different wallet engineer was lured into a fake job interview and told to run a coding "assignment" on their work computer. Binance security did not catch this one.
9to5Mac says Binance froze nearly $3B of the stolen funds. The column describes the attackers as "widely speculated" to be North Korean.
What is still unconfirmed
Most of what is known comes from Binance alone, the 9to5Mac author notes. A few details are inferences, not statements:
- The Mac. Binance never actually says "Mac." The malware it published targeted
/opt/homebrew, which is where Homebrew lives on Apple silicon Macs, so 9to5Mac infers an M-series MacBook. - The ad. The author says he cannot confirm the fake installer was a sponsored search ad. Binance only says "a search engine."
- The attribution. North Korea is named by TRM Labs' headline and widely suspected, but this article relies on 9to5Mac's reporting of those claims.
This pattern has hit Mac developers before
The $1.5B Bybit heist "last year" also began on a developer's Mac, according to researcher Christopher Lopez, as cited by 9to5Mac. Fake Homebrew pages are a known lure, not a new trick.
How to install Homebrew without getting a fake
Homebrew installs by pasting a command into Terminal, which is exactly why a cloned page works: the fake looks identical and the paste runs whatever the attacker wrote. Some habits that close that gap:
- Don't install developer tools from a search result. Binance's June incident started with a clone found via Google Search. Skip anything labeled as an ad, go to the Homebrew project's official site directly, and save a bookmark once you've confirmed it so you never have to search again.
- Read the command before you paste it. Check the web address in the command against the official site you navigated to. A lookalike domain, or a script hosted somewhere unrelated to the project, is the sign to stop.
- Treat the AI coding tool search the same way. The June entry point started with a search for an AI coding tool. Get those tools from the vendor's own site, not from a search result.
Never run an interview test project on a work machine
The September phase is the one Binance didn't catch, and it needed no fake website at all. A recruiter, a plausible job and a "coding assignment" got code running on a machine with access to wallets.
If you're job hunting, do take-home tests on a separate computer or a throwaway virtual machine that has no access to work accounts, keys or wallets. If a recruiter insists you run their project on your current employer's laptop, treat that as the red flag it is.
Terminal paste warnings help, but only so much
macOS 26.4 introduced Terminal paste warnings. The 9to5Mac author says they might have helped here but probably wouldn't stop someone who believes they're doing a real interview test. A warning only works if you're suspicious enough to heed it.
What to watch next
Everything public so far traces back to Binance's November 3 account. Watch for independent investigators, including TRM Labs, to publish their own findings that confirm or correct the timeline, the Mac inference and the North Korea attribution.
