Dodgy download and spoofed job ad led to $6.3 billion Binance hack: attacker offered fake software and fake job to infiltrate company wallets and steal billions
Binance, the world’s largest cryptocurrency exchange, suffered a record-breaking $6.3 billion hack. The attack was not a single isolated breach but rather involved multiple coordinated steps to bypass the company’s security measures.
The initial compromise occurred when a Wallet DevOps engineer downloaded a tampered version of Homebrew, a popular third-party package manager for macOS. The engineer discovered and clicked on the malicious software through a search engine result, which the attacker had positioned to appear legitimate. Binance revealed that the attack also involved a fraudulent job posting designed to further infiltrate company systems and gain access to critical wallet infrastructure.
By compromising a DevOps engineer with access to wallet systems, attackers were able to escalate their privileges and eventually drain billions in cryptocurrency. The hack represents one of the largest cryptocurrency thefts in history and demonstrates how multi-vector social engineering attacks—combining malware distribution, fake job listings, and supply chain compromise—can circumvent even the security measures of major financial institutions. Binance emphasized that the breach required circumventing multiple layers of security rather than exploiting a single vulnerability, underscoring the sophistication of the operation.