The largest crypto theft on record began with a download on an engineer’s Mac, and the aftermath is now the most detailed public map of how a supply chain lure becomes a nine figure loss.
Binance published its initial findings this week: roughly $6.34B in digital assets left hot wallets on October 29, with about $2.85B frozen since. The FBI blames North Korea.
A search result that was never Homebrew
In June, a wallet DevOps engineer searched for a popular AI coding tool and installed a tampered Homebrew package. Security staff spotted the anomaly, swapped the machine and rotated credentials. They could not undo what had already happened: the engineer’s role on the wallet team was now known to the attackers.
The staging is familiar. SANS Internet Storm Center documented a fake Homebrew page pushing the MacSync stealer through malicious search ads, and the trick works because Homebrew is shell-driven: a lookalike needs only a copy and paste into Terminal, and macOS asks far fewer questions than for a signed app.
The job interview was the second door
By September, another engineer was approached on a recruiting platform by someone posing as a project director. Two video interviews followed, the first with a supposed HR contact who shared personal social media to build rapport, the second on a chat app. Then came an assignment in a code repository, opened on a work Mac. It ran during setup, replaced pyenv with a malicious build and opened a command channel. Binance says endpoint protection missed it.
On October 20 the intruders pivoted through an internal AI tool, moving to the wallet engineer’s laptop, where a container deployment token sat waiting.
Neither foot in the door needed a kernel exploit, only a package from the wrong place and code that ran on open.
