Skip to content
Record $6.3B Binance Hack Exploited Mac Malware and Job Spoofing

Record $6.3B Binance Hack Exploited Mac Malware and Job Spoofing

First seen 9 Nov 2026, 12:10 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 9, 2026 at 12:10 UTC
  • •The hack involved a compromised Homebrew installation and a fake job interview.
  • •Attackers exploited multiple engineers' systems to gain access to Binance's wallets.
  • •The incident is linked to a suspected North Korean hacking group.

The $6.3 billion hack of Binance, the largest cryptocurrency exchange, involved a series of sophisticated attacks starting with a compromised Homebrew installation downloaded by a Wallet DevOps engineer. This was followed by a fake job interview that led to the installation of malware on another engineer's Mac, enabling attackers to gain access to critical systems. The attackers used stolen credentials to access multiple machines, ultimately draining billions from Binance's wallets. The FBI suspects a North Korean hacking group is behind the attack, which Binance has partially mitigated by freezing stolen funds. The incident highlights vulnerabilities in corporate security practices, particularly regarding social engineering and software integrity.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 3h ago How this analysis works

Timeline

2026-11-04
Binance reveals details of the hack
Binance disclosed the hack's methods, including a compromised Homebrew installation and fake job interviews leading to malware installation.
PC Gamer
2026-11-09
Security Bite Podcast discusses the hack
The podcast featured insights on how Mac malware likely facilitated the Binance hack, emphasizing the role of compromised software.
9To5Mac

More articles in this cluster (3)

Following this threat?

Track Binance in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

How did the attackers gain access?
Attackers exploited a compromised Homebrew installation and conducted a fake job interview to install malware.
What is the current status of the stolen funds?
Binance has frozen approximately half of the stolen funds and covered the remainder.
What should companies do to prevent similar attacks?
Companies should enhance security training, verify job offers, and ensure software integrity before installation.