// 9TO5MAC — MOBILE & WEB
Security Bite: The record $6.3B Binance heist started with a fake Homebrew install on Mac
9to5Mac Security Bite is exclusively brought to you by Mosyle, the only Apple Unified Platform. Making Apple devices work-ready and enterprise-safe is all we do. Our unique integrated approach to management and security combines state-of-the-art Apple-specific security solutions for fully automated Hardening & Compliance, Next Generation EDR, AI-powered Zero Trust, and exclusive Privilege Management with the most powerful and modern Apple MDM on the market. The result is a totally automated Apple Unified Platform currently trusted by over 45,000 organizations to make millions of Apple devices work-ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple.
Last week, news broke that hackers had stolen $6.3 billion from wallets on Binance, the most popular cryptocurrency exchange in the world. The company was able to freeze about nearly $3 billion of it, but the attack quickly made headlines, and rightfully so, as the largest financial heist in human history.
At the time, I suspected, along with security researcher Christopher Lopez and plenty of others, that this could have very well started on a Mac. As Lopez pointed out, the $1.5 billion Bybit heist last year also began on a developer’s Mac. On top of that, Macs are hugely popular among DevOps engineers and crypto folks, and they’ve been on the receiving end of a steady stream of malware and social engineering campaigns over the past few years.
I can now say any suspicions that this heist originated on Mac were right. I’m still in a state of shock. Dazed not by the amount stolen, but how the said hackers did so using the same ol’ social engineering tricks they’ve been using for years. No sophisticated multi-milllion dollar underground zero-day here.
Yesterday, Binance published a more detailed breakdown of the attack. The company never actually says “Mac,” but the malware it published targeted /opt/homebrew, which is where Homebrew lives on Apple silicon Macs. In other words, this was almost certainly an M-series MacBook.
According to Binance, in June this year, a DevOps engineer working on Wallet searched for an AI coding tool and downloaded a malicious clone of the Homebrew installer in Google Search. Binance claims it caught it early and stopped any damage. However, what it didn’t know was that it allowed the attackers to learn which employees worked on its wallets. This was phase 1.
Fast forward a few months to September, a different engineer who, you guessed it, worked on wallets for Binance, was lured into a fake job interview. As these sort of social engineering attacks normally go, they told to run a coding “assignment” on their work computer. This was not caught by Binance security, and on October 29, the world learned that hackers (now widely speculated as North Korean hackers) walked off with billions.
Of course, most of what we know so far comes directly from Binance, so if you’re looking for more details on exactly how this happened, you’ll likely be left empty-handed.
It’s important to note here though, none of these two attack vectors are new. Back in early 2025, I wrote about fake Homebrew ads at the top of Google Search pushing Atomic Stealer to Mac users. Binance only says the engineer found his installer through “a search engine.” Of course, I can’t confirm it was a sponsored ad, but if history tells us anything…
This is a rather uncomfortable situation for Apple to be in. The largest financial heist in history happen on Mac last week, though to be fair, there’s no security feature that can stop a developer from running a script he wants to run.