Dodgy download and spoofed job ad led to $6.3 billion Binance hack: attacker offered fake software and fake job to infiltrate company wallets and steal billions

Dodgy download and spoofed job ad led to $6.3 billion Binance hack: attacker offered fake software and fake job to infiltrate company wallets and steal billions

I'm feeling fresh appreciation for my company's mandatory cybersecurity awareness course.

A chain of events that led to a record-breaking $6.3 billion mega-hack began with a dodgy download, so says the company that was hacked, Binance.

The world's largest cryptocurrency exchange says that the hack was not a "single isolated breach or simple phishing incident"; multiple steps were required to break through its security measures. It all began when a Wallet DevOps engineer (named Engineer A) downloaded a tampered Homebrew installation that was suggested to them by an unnamed search engine.

Homebrew is a third-party package manager for macOS. A report from the SANS Technology Institute, linked to in Binance's investigation, suggests that malicious adverts for Homebrew have been spotted in search engine results, hoping to ensnare users into installing malware on a user's PC.

"Our security team detected the anomaly, replaced the device, and rotated all related credentials as a proactive security action," Binance says. "However, Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker."

Then came a separate incident with a software engineer (named Engineer B). They were contacted through a job hunting platform (Binance says it was a legitimate platform) and was asked to attend a first-round interview with a HR representative. This was followed by up a second-round interview with the CEO. Not the HR representative, nor the CEO, however, were real; the company was made up.

The aim of the interviews? To offer Engineer B an 'assignment' that was really a repository of malicious code that executed during setup. The malware ran a series of commands and evasion techniques to avoid detection, thus avoiding Binance's security checks.

The attacker used Engineer B's now-compromised computer and an internal AI tool to gain control over two further machines: that of Engineer A and another Wallet Software engineer (Engineer C). They discovered a container deployment permission token on Engineer A's machine. With this, they could log into Engineer C's computer using the stolen credentials to create a container and trigger a malicious script to start the mega-hack that would drain $6.3 billion worth of funds from wallets used to store transitory funds by the exchange.

Keep up to date with the most important stories and the best deals, as picked by the PC Gamer team.

So, basically, the internet is a bad place, and you can't trust anyone. Or, at least, you have to have your wits about you—especially if you happen to have the key to a multi-billion dollar company's finances stored on your PC somewhere. Luckily, my PC is just pictures of my cat and a Steam backlog that won't quit.

That's actually some of the criticism levelled at the company. Should it have been possible to get this level of access even with spoofed ads and jobs?

And here's Binance co-founder Yi He on taking that criticism...

Reminder that the FBI reckons a North Korean hacking group is behind the attack, which North Korean officials have unsurprisingly denied. Binance has frozen roughly half of the funds that were initially stolen, and has already covered the rest.

1. Best overall:

Razer Blade 16 (2025)

2. Best budget:

Lenovo LOQ 15 Gen 10

3. Best 14-inch:

Asus Zephyrus G14

4. Best mid-range:

MSI Vector 16 HX AI

5. Best high-performance:

Lenovo Legion Pro 7i Gen 10

6. Best 18-inch:

Alienware 18 Area-51

Jacob has been writing about PC hardware and technology for over eight years. He earned his first byline at PCGamesN before joining PC Gamer. He spends most of his time building PCs, running benchmarks, and trying his best to learn Linux.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.