The attack on Binance began with… a malicious Google Search advertisement.
An engineer ensnared by a malicious search ad…
In June 2026, a DevOps engineer aimed to install an AI coding tool on his Mac. By clicking the advertised link in question, he found himself on a site urging him to copy-paste a script into the terminal to download the Homebrew package manager.
Running the script triggered a sequence of pop-ups. The first advised updating system settings to launch the application and presented a password field. The second asked for Terminal to be granted control of the Finder. The third announced a failure: “Your Mac does not support this application.” Meanwhile, the infostealer MacSync was collecting information, zipped in the /tmp folder before being sent to the C2 server.
Before Binance detected the anomaly and remedied it (by replacing the device and credentials), the attacker had mapped the engineer’s role and identified his colleagues.
… and another one through a bogus job offer
The second phase took place in September. Another Binance engineer was contacted on a professional network by a fake project director. This person arranged a video interview with a supposed HR manager. To build trust, the impersonator shared a social media account with “personal” photos and videos.
A second interview occurred via a messaging app, allegedly with the CEO. The engineer was asked to complete a “technical exercise.” In this setup, he downloaded, onto his work machine, a poisoned code repository. The malware found there replaced a legitimate Homebrew component (pyenv), installed a symbolic link, opened a zsh shell, and established a C2 communication, all without triggering the EDR.
A third workstation compromised to siphon crypto
This workstation was used, on October 20, to compromise the first engineer’s machine through an internal AI tool. The attacker extracted a container deployment authorization token.
On October 29, he used this token on a third engineer’s workstation, which was used to trigger the funds exfiltration script. It was around 9 p.m. in France when a first hot wallet sent about 233 million Ripple (XRP). This was followed by nearly one million Solana (SOL) and about 44 million in Optimism (OP).
Binance eventually received an alert about abnormal transfer volumes. The attack did not stop there, however. Another wallet, for instance, transferred 18,270 bitcoins (BTC).
To establish a form of persistence, the attacker hijacked an Ethereum mechanism: EIP-7702, which allows a smart contract to gain execution rights on a wallet without exposing the private key. He submitted 50 signature transactions to manipulate the nonce and lock permissions on the blockchain.
These permissions were independent of Binance’s normal withdrawal infrastructure. Recalling them was all the more difficult because the wallet in question used a multipartite signing system, meaning there was no single key that could be revoked immediately.
The final unauthorized move (about 2960 ETH and a few more) occurred at 00:56 on October 30. It was a transaction that had already been broadcast. It sat in the mempool. The delegation was revoked at 01:10, by signing a new authorization to the zero address.
