Binance has revealed how North Korean hackers spent months preparing to steal approximately $6.34 billion in cryptocurrency last week. According to a November 3 security report by the exchange, the attackers used a malicious Homebrew installation to compromise one engineer and a fake recruitment process to trick another into installing malware disguised as a coding assistant. "Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident," the exchange said.

Binance says the first known compromise occurred in June, when an engineer in Binance’s Wallet DevOps team searched online for a popular AI coding tool and downloaded an adulterated Homebrew installation. Homebrew is a package manager, used by developers to install and manage various software tools on macOS.