Security Bite: Record $6.3B Binance Heist Started With Fake Homebrew Install on Mac, 9to5Mac Reports

Two attacks targeted wallet staff

Months later, in September, another wallet engineer was drawn into a fake job interview. The engineer was told to run a coding assignment on a work computer, and Binance security did not detect this attack. The theft became public on October 29.

Why investigators point to Mac

Binance did not explicitly identify a Mac in its account. However, the malware it published targeted /opt/homebrew, a Homebrew location on Apple silicon Macs. The story’s author says that evidence strongly suggests an M-series MacBook was involved.

The report says the first engineer found the installer through a search engine. The author notes that fake Homebrew advertisements had previously been used to direct Mac users to Atomic Stealer, but says there is no confirmation that a sponsored ad was involved in this case.

Familiar tactics, limited detail

The author says the attacks relied on social engineering rather than a newly discovered zero-day. The piece also compares the incident with the $1.5 billion Bybit theft the previous year, which it says began on a developer’s Mac.

Binance’s published account is the source for the details currently described. The article says the company’s account does not provide a fuller explanation of exactly how the theft unfolded, and identifies North Korean involvement only as widely speculated.

Warnings may not be enough

The article describes the incident as an uncomfortable moment for Apple, while noting that security features cannot necessarily prevent a developer from choosing to run a script. It says Terminal paste warnings introduced in macOS 26.4 might have helped, but could fail to deter someone who believes a coding test is legitimate. The article says security researcher Christopher Lopez is scheduled to appear on the Security Bite Podcast to discuss the Binance case with its author, Arin Waichulis.