// TOM'S HARDWARE US — HARDWARE & GADGET
Binance heist began with fake job interviews and a malicious Homebrew download
North Korean hackers targeted two Binance employees on the way to a $6.3 billion heist
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Binance has revealed how North Korean hackers spent months preparing to steal approximately $6.34 billion in cryptocurrency last week. According to a November 3 security report by the exchange, the attackers used a malicious Homebrew installation to compromise one engineer and a fake recruitment process to trick another into installing malware disguised as a coding assistant. "Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident," the exchange said.
Binance says the first known compromise occurred in June, when an engineer in Binance’s Wallet DevOps team searched online for a popular AI coding tool and downloaded an adulterated Homebrew installation. Homebrew is a package manager, used by developers to install and manage various software tools on macOS.
Binance says it detected the unusual activity, replaced the engineer’s device, and rotated their associated credentials. However, those moves proved to be too little, too late, as the attackers had already learned about the employee’s role and identified colleagues working on the exchange's wallet infrastructure
The incident follows the compromise of another Binance software engineer who was contacted in September through a legitimate job hunting platform by a malicious actor posing as a project director. The fake recruiter arranged two interviews. One involved a purported HR representative who conducted a live video call and shared a social media account containing personal photos and videos to establish credibility, while the second involved someone posing as a CEO of a fictitious company.
Near the end of the interview, the engineer was asked to download a coding assignment containing a malicious software repository onto his work computer—a popular social engineering scheme. That malicious code executed during the setup process. At the time, Binance said the malware replaced a legitimate component of the Python version-management tool "pvenv" with a malicious version capable of executing commands and communicating with an attacker-controlled server. The exchange's endpoint security tools did not detect the malware at the time.
Those compromises began bearing fruit on October 20, as the attackers used the compromised computers associated with the fake interview and an internal AI tool to gain control over two wallet engineers' devices. They also discovered a container deployment permission token stored on the computer of the engineer initially targeted in June.
Later, on October 29, the attackers used stolen credentials to access another engineer's computer, deploy a container, and execute a malicious script. This gave them access to Binance's internal wallet signing service, allowing transactions from five hot wallets outside the exchange's normal withdrawal process.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.