Binance $6.3 Billion Heist Began With a Fake Homebrew on Mac

Homebrew is a package manager that developers use on macOS to install tools. The malware targeted the /opt/homebrew path, which is used on Macs with Apple Silicon chips. That suggests the compromised machine was a MacBook with an M-series processor.

A fake job interview

In September 2026, the attackers approached another engineer who works on Binance wallets and persuaded them to take part in a bogus job interview. The engineer was asked to complete a coding task on their work computer, a common ploy that exploits a candidate's wish to land a job so they run harmful files or commands.

Binance's security systems did not detect this stage. On October 29, details of the multibillion-dollar theft from the platform's wallets emerged. The hackers are widely suspected of links to North Korea, though the available information does not explain how the intrusion was carried out in full.

Why it matters for Mac users

The methods are not new. Fake Homebrew ads appeared at the top of Google results in early 2025, distributing the Atomic Stealer malware to Mac users. Binance has not confirmed whether the employee found the fake through a paid ad or an ordinary search.

The case raises questions about Apple device security, but the report notes that built-in protections cannot stop a developer from running commands or scripts they choose to execute. Paste warnings in Terminal, added by Apple in macOS 26.4, might have helped but would not have guaranteed a stop: a user who believes they are doing a coding test for a coveted job may carry on anyway. The lesson is to install software only from trusted sources.