Binance heist began with fake job interviews and a malicious Homebrew download
North Korean hackers stole approximately $6.34 billion in cryptocurrency from Binance through a sophisticated multi-stage campaign involving fake job interviews and malicious software.
According to a November 3 security report by the exchange, the attackers used a malicious Homebrew installation to compromise one engineer and a fake recruitment process to trick another into installing malware disguised as a coding assistant.
Sophisticated Campaign
Binance stated that this was not a single isolated breach but a carefully orchestrated operation. "Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident," the exchange said.
Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident.
Initial Compromise
The first known breach occurred in June when a Binance Wallet DevOps engineer downloaded an adulterated Homebrew installation while searching for a popular AI coding tool. Homebrew is a package manager used by developers to install and manage software on macOS systems.
Related
