Binance says the largest theft on record began with a fake software installer and a fake job test. The same tricks can hit any work computer.
Hackers stole $6.3 billion from wallets at Binance, the world's most popular crypto exchange. About $3 billion was frozen. Binance has now explained how it began, and it was not a high-tech break-in. An engineer downloaded a fake software installer, and months later another engineer ran a fake job interview test.
In June, a Binance engineer who worked on its wallets searched for an AI coding tool. The search led to a fake copy of the Homebrew installer. Homebrew is a tool Mac developers use to install other software. Binance says it caught that early and stopped any damage.
But the fake installer had a hidden cost. It let the attackers learn which employees worked on the wallets. In September, a different wallet engineer was lured into a fake job interview and told to run a coding assignment on a work computer. Binance security did not catch it. On October 29, the theft became public.
Binance never says the word Mac. But the malware it published targeted a folder used by Homebrew on newer Apple Macs, so an Apple laptop was almost certainly involved. A similar $1.5 billion theft at Bybit last year also began on a developer's Mac. Hackers are widely suspected to be North Korean, though that is speculation.
The key point is that nothing exotic was used. Fake Homebrew ads in Google results were reported in early 2025 spreading Mac malware. Binance only says the engineer found the installer through "a search engine," so it is unclear whether it was a paid ad. No security feature can fully stop someone who chooses to run a script. A warning in a recent Mac update might help, but a person eager to land a job may click past it.
Most home users were not the target of this plan, which aimed at people with access to money systems. But the tricks are not limited to crypto. Any business whose staff install tools from search results, or who hire developers, faces the same risk. Mac users who work in software or crypto should be most careful.
The alert box above lists the steps. The short version: get software only from official sites, and never run code a recruiter hands over on a work machine.
Everything so far comes from Binance itself, so details are thin. It has not said whether the installer was a paid ad, or exactly how the second attack got past its defenses. Who was behind it is still unconfirmed.
Type in the official address for any software you install, and never run code from a stranger or recruiter on a work computer.
EA has re-released 25 classic PC games at a discount until November 19, and Bethesda has finally given The Elder Scrolls VI a subtitle: Sentinel.
Read more: EA brings 25 classic PC games back, and Elder Scrolls VI gets a nameOpenAI released a ChatGPT for analysts and bankers that shows where each number came from, a feature that could matter well beyond finance.
Read more: OpenAI launches a ChatGPT built for Wall Street analystsA Kuala Lumpur firm now sells a SGD 1,500 check of what ChatGPT, Gemini, Perplexity and Google say about a named executive, after its founder's own test found mix-ups.
Read more: New Audit Checks What AI Chatbots Say About Business Leaders
