Security Bite: The record $6.3B Binance heist started with a fake Homebrew install on Mac

9to5Mac Security Bite is exclusively brought to you by Mosyle, the only Apple Unified Platform. Making Apple devices work-ready and enterprise-safe is all we do. Our unique integrated approach to management and security combines state-of-the-art Apple-specific security solutions for fully automated Hardening & Compliance, Next Generation EDR, AI-powered Zero Trust, and exclusive Privilege Management with the most powerful and modern Apple MDM on the market. The result is a totally automated Apple Unified Platform currently trusted by over 45,000 organizations to make millions of Apple devices work-ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple. Last week, news broke that hackers had stolen $6.3 billion from wallets on Binance, the most popular cryptocurrency exchange in the world. The company was able to freeze about nearly $3 billion of it, but the attack quickly made headlines, and rightfully so, as the largest financial heist in human history. At the time, I suspected, along with security researcher Christopher Lopez and plenty of others, that this could have very well started on a Mac. As Lopez pointed out, the $1.5 billion Bybit heist last year also began on a developer’s Mac. On top of that, Macs are hugely popular among DevOps engineers and crypto folks, and they’ve been on the receiving end of a steady stream of malware and social engineering campaigns over the past few years. I can now say any suspicions that this heist originated on Mac were right. I’m still in a state of shock. Dazed not by the amount stolen, but how the said hackers did so using the same ol’ social engineering tricks they’ve been using for years. No sophisticated multi-milllion dollar underground zero-day here. Yesterday, Binance published a more detailed breakdown of the attack. The company never actually says “Mac,” but the malware it published targeted /opt/homebrew, which is where Homebrew lives on Apple silicon Macs. In other words, this was almost certainly an M-series MacBook. The attack basically transpired in two steps. According to Binance, in June this year, a DevOps engineer working on Wallet searched for an AI coding tool and downloaded a malicious clone of the Homebrew installer in Google Search. Binance claims it caught it early and stopped any damage. However, what it didn’t know was that it allowed the attackers to learn which employees worked on its wallets. This was phase 1. Fast forward a few months to September, a different engineer who, you guessed it, worked on wallets for Binance, was lured into a fake job interview. As these sort of social engineering attacks normally go, they told to run a coding “assignment” on their work computer. This was not caught by Binance security, and on October 29, the world learned that hackers (now widely speculated as North Korean hackers) walked off with billions. Of course, most of what we know so far comes directly from Binance, so if you’re looking for more details on exactly how this happened, you’ll likely be left empty-handed. It’s important to note here though, none of these two attack vectors are new. Back in early 2025, I wrote about fake Homebrew ads at the top of Google Search pushing Atomic Stealer to Mac users. Binance only says the engineer found his installer through “a search engine.” Of course, I can’t confirm it was a sponsored ad, but if history tells us anything… This is a rather uncomfortable situation for Apple to be in. The largest financial heist in history happen on Mac last week, though to be fair, there’s no security feature that can stop a developer from running a script he wants to run. Sure, the Terminal paste warnings introduced in macOS 26.4 could have helped here. But realistically, if someone’s convinced they’re doing a coding test for a job they really want, a warning pop-up probably isn’t going to stop them. Here’s what that warning looks like: I’m having Christopher Lopez (@L0Psec) a professional macOS reverse engineer back on the Security Bite Podcast this week to talk about the Binance situation with me. Follow the show so you don’t miss that. Security Bite is 9to5Mac’s weekly deep dive into the world of Apple security. Each week, Arin Waichulis unpacks new threats, privacy concerns, vulnerabilities, and more, shaping an ecosystem of over 2 billion devices. Every other week on the Security Bite Podcast, he sits down with experts in the field to break down the most pressing topics. FTC: We use income earning auto affiliate links. More.