Malicious Homebrew clone and fake interview accessed engineer’s Mac

Binance estimated the total impact of the hack at around $6.3 billion on Oct. 30, 2026. The exchange’s preliminary probe named a compromised DevOps engineer’s laptop as the initial entry point into its systems.

On Nov. 9, 2026, 9to5Mac’s Security Bite podcast said a malicious Homebrew clone and a fake job interview were used to access an engineer’s Mac. Homebrew is a macOS package manager. macOS security researcher Christopher Lopez discussed the attack vector on the podcast.

Binance said investigators found no leaked wallet private keys. Richard Teng said on Oct. 30, 2026 that the investigation did not blame any person. Binance found more breach points after first pointing to a possibly hacked engineer’s laptop.

Verified frozen assets totaled $3 billion on Oct. 30, 2026. Earlier frozen assets hit $2.54 billion, correcting figures such as $1.8 billion, per Binance on Oct. 29, 2026. To cover hack losses, Binance reserved over $6.34 billion in company funds. Of that reserved amount, $5 billion was already held in the stolen tokens.

Binance will cover all losses through its SAFU fund and company money, Teng said on Oct. 30, 2026. SAFU is the exchange’s secure asset fund. Binance cooperates with the FBI to recover stolen funds, per Binance on Oct. 30, 2026.

An EIP-7702 delegation gave the attacker execution rights on a hot wallet and bypassed approval controls, Richard Teng said on Oct. 30, 2026. EIP-7702 is an Ethereum delegation feature that lets one account authorize another to act on its behalf. A hot wallet is a cryptocurrency wallet connected to the internet. The attacker ran a self-destruct mechanism to wipe tools and traces mid-breach, Teng said. Teng also said the breach was not a one-click action but a more complex attack process.

Security analysts suspect North Korea’s TraderTraitor is behind the attack, Cointelegraph reported on Oct. 30, 2026. TRM Labs assigned high confidence to TraderTraitor as the attacker using robust intelligence. The FBI named TraderTraitor as the group behind the February last year ByBit hack.

ZachXBT said Binance and Bitget stolen funds mixed in one address on Friday after arriving via THORChain. That, ZachXBT said, shows one actor likely stands behind both the Binance and Bitget exploits. Arkham Intelligence tagged wallets binance-hacker-1029 with roughly $5.84 billion in holdings, not a confirmed theft total.

Chainalysis put the theft at $5.912 billion when it occurred, four times the 2025 Bybit loss. Chainalysis co-founder Jonathan Levin set the theft at $6.4 billion, above Binance’s $6.3 billion estimate. Stolen-amount estimates conflict: Binance says $6.3 billion, Chainalysis says $5.912 billion, and Levin says $6.4 billion.

TRM Labs traced roughly 233.46 million XRP worth $296 million out of five Binance wallets from 20:05 to 20:09 UTC on Oct. 29. About 18,270 BTC moved at about 20:20 UTC on Oct. 29, followed by an Ethereum drain. Attackers readied the theft for at least 36 hours with test transactions and malicious Ethereum smart contracts. Smart contracts are self-executing code on a blockchain. TRM Labs counted about $6.36 billion in unauthorized transfers across ten blockchains by attack end.

The stolen XRP remained in a single attacker-controlled address with no outward moves by early Oct. 30, per Bitquery tracing. Because the XRP Ledger lacks Ethereum’s EIP-7702 delegation feature, the XRP transfers were plain signed transfers, TRM Labs said.

Teng set a 40-hour target to restore withdrawals and promised a full reserves report by Monday on Oct. 30, 2026. Binance halted withdrawals while overhauling its withdrawal service and linked addresses. Deposits keep working and withdrawals should restart as planned, per Binance on Oct. 30, 2026.

Frozen tokens cover USDT, USDC, RLUSD, USD1, XUSD, USDT0, WBETH, XAUT, PAXG, USDP and ARB, Binance said on Oct. 30, 2026. Yi He said Binance is buying replacement altcoins through OTC deals and exchanges. OTC deals are over-the-counter trades. Binance files company-fund reports with Abu Dhabi’s Financial Services Regulatory Authority under an older rule.

Arbitrum’s Security Council froze $30.5 million involving 74.6 million ARB and 8,425 ETH from the exploit on Oct. 30, 2026. World Liberty Financial froze $27 million of USD1 and $2 million of WLFI on Oct. 29, 2026. Aave froze V3 and V4 after the Binance exploiter borrowed 19,762 WETH for $44.6 million against 60 million USDT, per LlamaRisk on Oct. 29, 2026. Ripple stablecoin chief Jack McDonald said Ripple is freezing RLUSD tied to the hack on Oct. 29, 2026. First Digital chief Vincent Chok said First Digital froze FDUSD stolen in the attack on Oct. 29, 2026.

Zhao said Tether froze about $971 million and Circle froze about $823 million on Oct. 29, 2026. Blockaid flagged roughly $3.3 billion in suspicious transfers tied to Binance wallets. Changpeng Zhao called the activity a hack on Oct. 29, 2026.

BNB dropped 8 percent to roughly $693 and Ether fell 5.7 percent to about $2,211, per CoinGecko on Oct. 30, 2026. Wintermute and GSR disclosed Binance exposure below 20 percent and 5 percent of net equity, per Cointelegraph on Oct. 29, 2026.

Ido Ben-Natan said vulnerable signing systems probably enabled the breach and EIP-7702 let attackers act in one step. Ben-Natan called the breach a possible key-misuse case in which signers were tricked without key theft. Chainalysis said attackers likely automate stolen-fund transfers, spotting thousands of quick transactions. Standard Chartered’s Geoffrey Kendrick said the breach might move crypto trading toward DEXes and aid Uniswap on Oct. 30, 2026. DEXes are decentralized exchanges. Yahoo Finance said on Oct. 30, 2026 that it is unclear how the attacker obtained cross-chain withdrawal authority or if the stolen XRP can be recovered.