Binance $6.3 Billion Heist Traced to Fake Homebrew Download on Mac

The investigation into one of history’s largest financial thefts has uncovered new specifics regarding the initial compromise of cryptocurrency exchange Binance, which resulted in the loss of approximately $6.3 billion. According to 9to5Mac, the cyberattack originated from a social engineering scheme targeting company staff, specifically exploiting the download of a counterfeit version of the software package manager Homebrew on Apple computers.

Initial Breach via Malicious Installer

The intrusion timeline begins in June 2026, when a DevOps engineer at Binance sought coding tools powered by artificial intelligence. The employee downloaded a malicious, fake copy of Homebrew through Google search results. While Binance detected this early attempt and prevented immediate damage, the incident inadvertently allowed attackers to identify personnel managing the platform’s digital wallets.

Homebrew serves as a package management system for macOS, enabling developers to install necessary applications and tools. The malware targeted the /opt/homebrew directory, the standard installation path for Homebrew on Macs equipped with Apple Silicon processors. This technical detail suggests the compromised device was likely a MacBook featuring an M-series chip.

Social Engineering Tactics Evolved

Months later, in September 2026, hackers shifted focus to another engineer responsible for Binance’s wallet infrastructure. They lured the target into a fraudulent job interview scenario, requesting the completion of a programming task as part of a hiring assessment using their work computer. This method leverages the victim’s desire for employment to execute harmful files or commands, a common tactic in social engineering attacks.

Binance’s security systems failed to detect this second phase of the operation. By October 29, the full extent of the theft became apparent, revealing billions of dollars had been drained from the exchange’s cryptocurrency wallets. Although there is widespread suspicion linking the perpetrators to North Korea, available information does not yet clarify all aspects of how the breach was executed.

macOS Security Concerns Raised

The techniques employed are not entirely novel. Earlier in 2025, fake advertisements for Homebrew appeared at the top of Google search results, distributing malware known as Atomic Stealer to target Mac users. Binance has not confirmed whether the employee accessed the counterfeit software via a paid advertisement or organic search result, but the event highlights the risks associated with downloading programs from unverified sources.

The incident prompts broader questions about the security of Apple devices, given that the largest heist in history commenced on a Mac. However, reports note that protection systems cannot prevent developers from executing commands or scripts they choose to run voluntarily. Apple introduced warnings for pasting commands into Terminal with the macOS 26.4 update; while these alerts might have helped mitigate the attack, they do not guarantee prevention. Users may still proceed with execution if they believe they are completing a legitimate job test.