Binance $6.43B Theft Used Trojanized Homebrew and Fake CEO Interview for Wallet Signing Access

The campaign began with Engineer A pulling a poisoned Homebrew package while searching for an AI tool, exposing wallet infrastructure details despite credential rotation. In September a second engineer received a LinkedIn-style outreach from a fabricated Project Director, completed a video interview with shared social media artifacts, then executed a malicious repository during a chat-app assignment that substituted a dev tool component and beaconed to attacker infrastructure. Evidence shows the malware removed forensic artifacts and leveraged Engineer B's machine to query internal AI systems for Engineer A's container token.

Binance's timeline reveals a 16-week dwell period with no public CVE or independent forensic report released. Official statements emphasize multi-stage sophistication but omit whether the compromised AI tool retained logs or whether transaction signing required multi-party approval that was bypassed. Cross-referencing with prior incidents such as the 2022 Ronin Bridge exploit and 2021 Poly Network theft shows repeated targeting of DevOps and signing services through supply-chain or social vectors rather than pure code vulnerabilities.

Reconstruction of the wallet environment and decommissioning of affected tokens reduces immediate re-exploitation risk, yet the incident exposes a persistent pattern: crypto exchanges continue to grant high-privilege engineers internet-facing development workflows without hardware-enforced signing or air-gapped AI tooling. Law-enforcement and blockchain analytics partners are now tracing the 6.43 billion in outflows.

Next steps include mandatory hardware security modules for all signing operations and behavioral monitoring tuned to anomalous container deployments. Industry-wide, similar recruitment lures are likely to recur against other large custodians within the next quarter.