Binance Hack: Tampered Homebrew Package Delivers macOS Stealer; Infostealers and AI-Powered Profiling Feed Social Engineering (TraderTraitor attribution)

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5986 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Tampered Homebrew Installer Fetched From Non-Official Source (macOS) — Exploitation

TL-2026-5986 (TraderTraitor / Binance hot-wallet theft): a Wallet DevOps engineer installed a tampered Homebrew package found via search engine, which deployed a macOS stealer. Detects curl/wget on macOS retrieving a Homebrew-related script from any URL that is not an official Homebrew location (raw.githubusercontent.com/Homebrew, brew.sh, formulae.brew.sh, github.com/Homebrew, ghcr.io/v2/homebrew).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195, T1204.002, T1036
• Data sources: macos_edr_process_events, splunk_cim_endpoint_processes, defender_for_endpoint_macos
• Severity: high
• Confidence: high

Splunk SPL

| tstats summariesonly=false count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("curl","wget") AND Processes.process="*brew*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process
| rename "Processes.*" as *
| where NOT match(process, "(?i)https://(raw\.githubusercontent\.com/Homebrew/|([a-z0-9-]+\.)?brew\.sh/|github\.com/Homebrew/|ghcr\.io/v2/homebrew/)")
| eval firstTime=strftime(firstTime,"%Y-%m-%d %H:%M:%S"), lastTime=strftime(lastTime,"%Y-%m-%d %H:%M:%S"), threat="TL-2026-5986 tampered Homebrew installer"
| table firstTime lastTime dest user parent_process_name process_name process count threat

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath startswith "/"
| where FileName in~ ("curl", "wget")
| where ProcessCommandLine contains "brew"
| where ProcessCommandLine !matches regex @"(?i)https://(raw\.githubusercontent\.com/Homebrew/|([a-z0-9-]+\.)?brew\.sh/|github\.com/Homebrew/|ghcr\.io/v2/homebrew/)"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine

Sigma

title: Homebrew Installer Fetched From Non-Official Source
id: 5f3b2a10-7c4e-4d1a-9b62-3e8a1c7d0f11
status: experimental
description: Detects curl/wget on macOS retrieving a Homebrew-related script from a URL that is not an official Homebrew location, as in the tampered Homebrew installer lure of TL-2026-5986 (Binance incident, TraderTraitor).
references:
  - https://9to5mac.com/2026/11/04/security-bite-the-record-6-3b-binance-heist-started-with-a-fake-homebrew-install-on-mac/
  - https://flare.io/learn/resources/blog/binance-hack-infostealers-ai-powered-social-engineering
author: Threadlinqs Team
date: 2026-11-13
tags:
  - attack.initial-access
  - attack.t1195
  - attack.execution
  - attack.t1204.002
  - attack.defense-evasion
  - attack.t1036
logsource:
  category: process_creation
  product: macos
detection:
  selection_img:
    Image|endswith:
      - '/curl'
      - '/wget'
  selection_brew:
    CommandLine|contains: 'brew'
  filter_official:
    CommandLine|contains:
      - 'https://raw.githubusercontent.com/Homebrew/'
      - 'https://brew.sh/'
      - 'https://formulae.brew.sh/'
      - 'https://github.com/Homebrew/'
      - 'https://ghcr.io/v2/homebrew/'
  condition: selection_img and selection_brew and not filter_official
falsepositives:
  - Internal mirrors of Homebrew or private taps hosted on company infrastructure
  - Developers testing alternate Homebrew install scripts
level: high

Known false positives:

• Internal Homebrew mirrors or private taps hosted on corporate infrastructure
• Developers testing alternate or forked Homebrew install scripts

Tuning notes: Run as a scheduled search over the last 15-60 minutes against the Endpoint.Processes data model populated from your macOS EDR (Jamf Protect, CrowdStrike, Defender for Endpoint, osquery). Add your internal mirror hostnames to the NOT match allowlist and scope first to Wallet DevOps / developer device groups. A URL embedding an official Homebrew string inside a query parameter would evade the allowlist; review hits where the host differs from the allowlisted hosts.

• 🔒 Fake Job-Interview Coding Assignment Executed From Downloads or Temp Path · unlock with TL Creds
• 🔒 macOS Stealer Collection of Browser Credentials, Cookies and Wallet Extension Data · unlock with TL Creds
• 🔒 Okta Session Reuse From Multiple IPs and Countries (Stolen Session Cookie Replay) · unlock with TL Creds
• 🔒 Homebrew Prefix Binary Tampering By Non-Homebrew Process ([indicator]) · unlock with TL Creds
• 🔒 macOS Keychain Extraction via security CLI (Dump, Generic Password, Browser Safe Storage) · unlock with TL Creds
• 🔒 macOS System Profiling by Interpreter or Temp-Path Parent (Stealer Fingerprinting) · unlock with TL Creds
• 🔒 macOS Fake Password Prompt via osascript Hidden-Answer Dialog (Stealer Keychain Phish) · unlock with TL Creds
• 🔒 Connections to Community-Observed DPRK-Linked Sibling Infrastructure (TL_OSINT_Scan) · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5986.

Technical analysis

Flare cannot confirm that stolen infostealer data was used in the attack.

On 2026-10-29 roughly $6.36B (about $6.23B at later prices) was drained from Binance hot wallets across ten chains (XRP Ledger, Ethereum, Bitcoin, Tron, Solana, Arbitrum, Optimism, Base, Avalanche, Polygon). TRM Labs attributes the theft to TraderTraitor with high confidence based on on- and off-chain intelligence and on shared patterns with the Bybit (Feb 2025) and KelpDAO (Apr 2026) thefts: small Tornado Cash withdrawals funding an operator wallet, staging well ahead of the theft, and pre-obtained signatures executed in one burst. Binance has not published a root cause for the hot-wallet signing compromise.

According to Binance's 2026-11-03 update (as relayed by Flare and 9to5Mac; the primary LinkedIn post returned HTTP 403 and was not directly read), in June 2026 an engineer ('Engineer A') on the Wallet DevOps team searched for a popular AI coding tool and downloaded a tampered Homebrew installation through a search engine result. The installer deployed macOS stealer malware; no malware family is named by Binance or Flare. Binance says its security team detected the anomaly, replaced the device and rotated related credentials, but that the engineer's role and wallet-infrastructure colleagues were 'exposed to the hacker'. 9to5Mac reports that the malware referenced the /opt/homebrew path (Apple-silicon Homebrew prefix). In September 2026 a different Wallet engineer was lured by a fake job interview into running a coding 'assignment' on a work computer; Binance did not catch this activity. Binance also describes a broader campaign of fraudulent job interviews, developer-tool lookalikes, compromised packages and browser extensions, and fake video-conferencing apps.

On-chain, TRM describes the operator deploying and testing attack code on two wallets, rehearsing on a third, then installing it on the Binance Ethereum hot wallet about four hours later. Fifty EIP-7702 authorizations spanning consecutive nonces were submitted in one transaction, turning the hot wallet into an operator-controlled sweeper; the whole ETH balance (167,464 ETH, 63 tokens) was swept within about 3 min 24 s. Valid signatures on nine other chains within about 30 minutes suggest compromise of the hot-wallet signing infrastructure. Laundering used discounted OTC-style sales via UniswapX, Aave and JustLend borrowing, hop-wallet swaps, RLUSD DEX sales and a BTC peel chain. About $2.7B was frozen by Tether, Circle, Ripple, World Liberty Financial and the Arbitrum Security Council; the attacker was reported to still hold about $2.4B.

Flare's 2026-11-13 article links the incident to the infostealer ecosystem. Typical macOS stealers capture the login keychain via fake password prompts, browser credentials, cookies and session tokens, crypto-wallet files and a system profile. Flare also documents AI-driven victim-profiling features advertised in Bee Stealer V2.1 ('AI Profile', summer 2026, tested by BlackFrog in October 2026), AVENGER and VOLTA-AUTODOXER (late July to end of October 2026). Flare explicitly states it does not know how stolen data was used in the Binance attack, and the AI-profiling link is speculation. Flare's separate review of historical stealer logs found 219 logs (Feb 2022 to Oct 2026) with 74 distinct @binance.com usernames, with Okta, Kibana and Git destinations; these are leads only and no evidence ties them to this incident. Single primary reporting chain: Binance's own post is relayed secondhand; attribution to TraderTraitor is not Flare's own analysis.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1036 Masquerading

Credential Access

T1056.002 Input Capture: GUI Input Capture; T1539 Steal Web Session Cookie; T1555.001 Credentials from Password Stores: Keychain; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Discovery

T1082 System Information Discovery

Initial Access

T1195 Supply Chain Compromise; T1566 Phishing

Execution

T1204.002 User Execution: Malicious File

Lateral Movement

T1550.004 Use Alternate Authentication Material: Web Session Cookie

Impact

T1657 Financial Theft

Remediation

Immediate actions

• Block and audit developer installs of Homebrew and AI coding tools; install only from the official brew.sh instructions typed from a verified source, not search-engine results
• Hunt macOS developer endpoints for unexpected processes or files referencing /opt/homebrew and for fake password prompts (osascript dialogs) launched from shells
• Alert on any EIP-7702 delegation on treasury or hot wallets and keep a pre-approved revocation method ready
• Treat requests for many EIP-7702 authorizations across consecutive nonces as a compromise indicator
• Contain exposed sessions, tokens and secrets of any possibly-infected engineer, not just reset passwords

Workarounds

• Enforce phishing-resistant MFA and short-lived session tokens to limit stolen-cookie replay
• Use application allowlisting and EDR behavioral detection on macOS developer fleets

Longer-term hardening

• Separate signing infrastructure and approval paths by chain and wallet tier
• Adopt identity exposure management that reviews full stealer-log context (cookies, tokens, files) for corporate identities
• Run intelligence-driven red-team exercises and tailored training on fake job interviews, fake coding assignments and fake conferencing apps
• Prohibit running candidate coding assignments or interview tooling on corporate wallet-infrastructure workstations
• Screen deposits and counterparties against labeled addresses

Affected and fixed versions

• Binance — Hot wallet signing infrastructure (XRPL, Ethereum, Bitcoin, Tron, Solana, Arbitrum, Optimism, Base, Avalanche, Polygon)
  Vulnerable versions: Not applicable; operational compromise
• Homebrew (impersonated) — Tampered Homebrew installer obtained via search engine; legitimate Homebrew not reported compromised
  Vulnerable versions: Counterfeit installer delivered June 2026
• Apple — macOS developer workstations (Apple silicon inferred from /opt/homebrew path)
  Vulnerable versions: Not specified

Timeline

• 2026-06-01 June 2026 (exact day not disclosed): Binance Wallet DevOps 'Engineer A' downloads a tampered Homebrew installer found via a search engine while seeking an AI coding tool; macOS stealer malware deployed. Binance detects the anomaly, replaces the device and rotates credentials.
• 2026-09-01 September 2026 (exact day not disclosed): a different Wallet engineer is lured by a fake job interview into running a coding 'assignment' on a work computer; Binance did not catch this activity.
• 2026-10-28 Morning of Oct 28 (UTC): three small Tornado Cash withdrawals fund the operator wallet (TRM Labs).
• 2026-10-29 Attack code tested on two wallets and rehearsed on a third; about four hours later installed on the Binance Ethereum hot wallet. XRPL, Bitcoin (18,270 BTC), Tron, Solana, Optimism, Avalanche and Polygon wallets drained; ETH hot wallet swept in about 3 min 24 s via 50 EIP-7702 authorizations. Roughly $6.36B stolen.
• 2026-10-30 Binance reports about $2.54B verified frozen (23:35 UTC Oct 29); Arbitrum Security Council forces transfers out of attacker wallet at 00:08 UTC. Total frozen later reported at about $2.7B-$3B across Tether, Circle, Ripple, World Liberty Financial and Arbitrum.
• 2026-11-03 Binance publishes initial findings linking the intrusion trail to the June tampered Homebrew install and September fake job interview; states no evidence of wallet private-key leakage and that root cause is under investigation.
• 2026-11-04 9to5Mac Security Bite analyzes the Mac/Homebrew angle, noting the malware referenced locked-ioc-2.
• 2026-11-13 Flare publishes analysis tying the incident to the infostealer ecosystem and AI-driven victim profiling (Bee Stealer V2.1, AVENGER, VOLTA-AUTODOXER); states it cannot confirm stolen data was used in the attack.

Sources cited

• North Korea Steals USD 6.36 Billion from Binance in the Largest Hack in History (TRM Labs) trmlabs.com · Research · 2026-10-29
• 29 October Binance Security Incident: Initial Findings and Response (Binance, LinkedIn) linkedin.com · Vendor report · 2026-11-03
• Binance attack stealer logs analysis (Flare) flare.io · Research
• StealerLens stealer log analysis (Flare) flare.io · Research
• Fake Homebrew ClickFix campaign delivering Cuckoo Stealer on macOS (Hive Pro; separate campaign, context only) hivepro.com · Research
• The Binance Hack, Infostealers, and AI-Powered Social Engineering (Flare) flare.io · Blog · 2026-11-13
• Security Bite: The record $6.3B Binance heist started with a fake Homebrew install on Mac (9to5Mac) 9to5mac.com · News · 2026-11-04
• Dodgy download and spoofed job ad led to $6.3 billion Binance hack (PC Gamer) pcgamer.com · News

More in supply chain

• Cursor Supply-Chain Compromise: Leaked Fireworks AI Key Leads to Backdoored Anthropic.claude-code Extension (2.1.312/2.1.313) in Cursor Marketplace Cache
• nDiligence 'Attack the Glass' (ATG): Runtime Client-Side Rendering Supply-Chain Vulnerability Class Across 50 Platform Types
• wfx-loot: GitHub Actions CI secret stealer pushed to public repositories using stolen GitHub credentials
• Quantum Systems QBase ground-control software update reportedly malware-laden; Bundeswehr drones grounded as precaution
• TOPHIT: One-operator npm typosquat flood (@prime0 scope, 85 packages) co-hosted with GPU-cryptojacking C2

More from TraderTraitor

• FaceStealer: DPRK (APT38-attributed) deepfake meeting social-engineering campaign disrupted by FBI/DOJ; $1.2B of stolen Binance crypto seized (TraderTraitor)
• TraderTraitor (DPRK-aligned) FLATROOF and ROOFDECK macOS Backdoors Resurface on IT Services Victim With No Crypto Ties
• Binance Wallet Infrastructure Compromise via Fake Job Interviews, Trojanized Homebrew Installer and Internal AI Tool Abuse (~$6.3B Theft, TraderTraitor)
• TraderTraitor (North Korea) months-long campaign leads to $6.34B Binance cryptocurrency theft
• Binance security incident: compromised DevOps engineer laptop leads to service container access and ~$6.3 billion in unauthorized withdrawals
• Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform FLATROOF and ROOFDECK Malware

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages