Update: This follows my post on the FBI pinning the Binance theft on North Korea. Binance has now published how it happened, and it’s a textbook multi-stage campaign.
What’s new
- June 2026: A Wallet DevOps engineer searched for a popular AI tool and downloaded a trojanized Homebrew installer. Binance caught it and rotated credentials, but details about his role and teammates had leaked.
- September 2026: A second engineer was approached on a real job site by a fake “Project Director,” got an HR interview, then a “CEO” interview on a chat app, and was told to download an “assignment” repo onto his work laptop. The setup step ran malware.
- The malware swapped a real dev-tool component for a poisoned one, talked to an attacker server, and wiped forensic traces. Binance says compromised internal AI tooling and an advanced transaction-authorization method were part of the chain. The total is now put at $6.43 billion.
My take
Two habits would have broken this chain: only install tools from the official source, never from a search ad, and never run a stranger’s “take-home test” on a work machine. Use a throwaway VM.
God Bless, and Happy hacking!
