Security Bite: The record $6.3B Binance heist started with a fake Homebrew install on Mac

9to5mac.com Nov 5, 2026

Security Bite: The record $6.3B Binance heist started with a fake Homebrew install on Mac

Curated by Shubham · TechCapsules · Nov 5, 2026

AI-summarised brief · reviewed before publication

Last week, hackers stole $6.3 billion from Binance wallets, the largest financial heist ever. Binance froze nearly $3 billion, but the breach still dominated headlines. Security researcher Christopher Lopez and others suspect the attack began on a Mac, echoing the $1.5 billion Bybit theft that also started on a developer’s Mac. Mac users, especially DevOps and crypto professionals, have faced increasing malware and social‑engineering attacks, raising concerns about platform security.

💡 Why It Matters

· The incident underscores how even high‑profile exchanges remain vulnerable to sophisticated, platform‑specific attacks, prompting a reevaluation of security practices across the crypto ecosystem.

Read full article on 9to5mac.com

Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to…

Binance disclosed that a $6.43 billion theft from its platform resulted from a coordinated, multi‑stage attack that began with a trojanized Homebrew installer used by a Wallet DevOps engineer in June 2026. The malware installed a malicious AI tool, exposing internal credentials. In September, attackers posed as a recruiter on a job‑hunting site, conducted fake interviews with a second engineer, and delivered a poisoned code repository that compromised his workstation. By October, the threat actors leveraged the compromised machines and an internal AI tool to hijack a container deployment token, gain control of additional engineers, and access the wallet‑signing service, enabling unauthorized transactions. Binance has since rebuilt the affected wallet system, hardened device and AI controls, and expanded AI‑driven anomaly detection.

💡 The breach shows how social‑engineering via fake recruitment can infiltrate even highly secured crypto exchanges, turning internal developer tools into a conduit for massive fund loss.

techcrunch.com · Nov 1

Binance resumes withdrawals following $6.3 billion breach

Binance announced it would resume withdrawals in a phased manner after a $6.3 billion hack that froze all deposits and withdrawals. The exchange reported covering 95 % of the stolen assets and is still sourcing the remaining, less liquid holdings. Binance confirmed it would absorb the financial loss and not pass it on to users. Withdrawals will restart gradually, with Bitcoin and Ethereum services partially suspended, and users may experience delays. The company will publish a detailed incident report post‑investigation.

💡 The swift restoration of withdrawals signals Binance’s resilience and commitment to user trust amid a massive security breach. It also underscores the broader industry challenge of safeguarding digital assets against sophisticated cyber threats.

thehackernews.com · Nov 1

FBI Links North Korea’s TraderTraitor to Record $6.43 Billion Binance Crypto Heist

The FBI announced that the North Korean‑aligned hacking collective known as TraderTraitor, also identified as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899, stole more than $6.43 billion in cryptocurrency across 11 blockchains. investigators from the FBI, U.S. Secret Service and IRS‑CI said the group primarily converted the loot into Ethereum before moving it through decentralized‑finance swaps and instant‑swap services for further laundering. Binance resumed phase‑one withdrawals after pausing them following the breach, noting that deposits remain unaffected. The theft surpasses the $1.46 billion Bybit hack and represents the largest crypto heist on record, with 82 % of the stolen value on Ethereum and Bitcoin. On‑chain analysis shows $2.85 billion of the assets have been frozen by Tether, Circle, Ripple, Arbitrum and Optimism.

💡 The haul demonstrates how state‑backed actors can weaponize decentralized finance to fund illicit programs, forcing regulators and exchanges to tighten cross‑chain monitoring. It also proves that even leading platforms like Binance can be disrupted by sophisticated supply‑chain attacks, reshaping risk assessments for the broader Web3 ecosystem.

thehackernews.com · Nov 1

Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script

On October 29, malicious code injected into Polymarket’s website hijacked a third‑party DebugBear page‑speed script and used signed‑in traders’ credentials to transfer their positions and funds to a hacker‑controlled wallet. The attack moved roughly $2.64 million worth of POL tokens from 33 wallets in under an hour, after which the funds were quickly split among three addresses. Polymarket identified the breach, removed the compromised script within an hour, cleared caches, reset sessions and paused trading. The company is refunding about $2.7 million to 726 affected wallets and an additional $1.19 million to roughly 5,500 users impacted by the trading pause, totaling $3.9 million in reimbursements. DebugBear confirmed its DNS was compromised but its own systems remain intact. The incident underscores risks of third‑party scripts.

💡 Exploiting a trusted monitoring script let attackers bypass user authentication, exposing a systemic vulnerability in how crypto platforms rely on external code.

thehackernews.com · Oct 31

Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold…

Trezor has warned that a Safe 5 hardware wallet purchased from reseller CryptoBilis contains an unauthorized circuit board that captures and transmits the recovery phrase via a cellular module. The device, sold through Tokopedia in August 2026, was reported by an Indonesian customer who noticed a weight difference and later discovered the board. Trezor is urging all CryptoBilis buyers since March 2026 to replace their wallets and is sending the suspect unit to its lab for examination. No funds have been lost, and the company has not yet confirmed the board’s functionality.

💡 The incident underscores the growing risk of supply‑chain tampering in crypto hardware, forcing users to trust manufacturers over resellers. It also highlights the need for stricter vetting of third‑party distributors in the rapidly expanding digital‑asset market.

thehackernews.com · Oct 29

FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering

The U.S. Department of Justice announced the seizure of the Virtualine domain, a bulletproof hosting provider used for child sexual abuse material, nonconsensual intimate content, and Bitcoin money laundering. The FBI, alongside international law‑enforcement partners, seized the site after Virtualine continued to host a criminal forum, Vendor 1, despite repeated abuse notices. Virtualine offered paid plans, accepted unhosted Bitcoin payments, and allegedly laundered funds for cybercriminals. The operator issued a rebuttal letter following the seizure.

💡 This action disrupts a key infrastructure hub that enables the distribution of illegal content and the laundering of illicit funds, tightening the net around cybercriminal operations worldwide.