How a fake Homebrew ad led to Binance's $6.34B crypto heist, per Workbrew postmortem
zetalyrae · x · 2026-11-14
Workbrew's blog postmortem walks through the largest-ever crypto heist ($6.34B lost to North Korean attackers). Attackers bought a search ad above the real result, serving a tampered Homebrew installer that also deployed a popular AI coding tool.
- June 2026: Engineer A on the wallet DevOps team was compromised. Protocol response (device replacement, full credential rotation) appeared to stop data loss — but attackers kept the names and roles of the engineer and teammates, giving them an entry point.
- September 2026: Three months later, attackers launched a social-engineering campaign via a fake recruiting process, using legitimate-platform profiles to build trust with Engineer B.
Key lessons: even innocuous info like job titles fuels attacks; organizations should provide sanctioned install paths so nobody has to search. The author argues adblocking is now a more effective safety measure than antivirus.
More from Safety
- Microsoft paper shows 7 edited neurons can backdoor an AI agent with a timed trigger — DimitrisPapail · 2026-11-14
- Ex-OpenAI VP Brundage: AI has no minimum safety standards and no whistleblower protection — Miles_Brundage · 2026-11-14
- Ex-Nvidia CEO misled top lawyer over affair with Chinese businesswoman, sources say — 0xkarasy · 2026-11-14
- Robert Wiblin: Frontier AI staff who lose faith have a moral duty to speak out — trevposts · 2026-11-14
- Smearing vaseline on a robot camera: 5 frontier models attempt dangerous tasks at 97% — 量子位 · 2026-11-14
- Uber notifies users of personal data exposure in breach at a service provider — rakyll · 2026-11-14