Binance ties $6.43 billion theft to fake job interviews and a tampered Homebrew install

Binance said on Tuesday that the theft of $6.43 billion in assets from the exchange was the result of a "sophisticated, multi-stage campaign" that included a tampered Homebrew installation and a recruitment-themed social engineering attack aimed at two of its engineers.

The company pushed back on the idea that this was one bad email. "It was not a single isolated breach or a simple phishing incident," it said, according to The Hacker News.

That's most of what's public. The account names two engineers as the targets and a tampered Homebrew install as one component, but the write-up as published doesn't lay out the sequence between those pieces, how the tampering was delivered, or when the campaign started. Nobody outside Binance has published an independent reconstruction yet.

The detail worth flagging for defenders is the mix. A developer toolchain compromise and a fake interview process are two different doors, and the second one doesn't need a vulnerable package at all. Anyone who runs hiring loops with outside candidates should assume the calendar invite and the take-home repo are both attack surface.

We'd want the full timeline before drawing lessons from it. Until then, the useful takeaway is narrow: check how your engineers install tooling, and check who gets to send them a link during a hiring process.

Binance hasn't said how much of the $6.43 billion was recovered, and the report doesn't address it.