#homebrew

November 4, 2026

Binance published a four-stage reconstruction of the $6.3 billion heist, and the new detail is the lateral movement. In September an engineer was approached on a job-hunting platform, run through two fake interviews, and told to pull a "coding assignment" from a code repository; the payload dropped a malicious pyenv_ into the macOS Homebrew directory, deleted the legitimate pyenv, re-pointed the symlink and spawned zsh, and went undetected by endpoint tooling at the time (BleepingComputer). On October 20 the attacker used that host plus an internal AI tool to take control of a Wallet DevOps engineer and a second wallet engineer, picking up a container deployment permission token that led to wallet-signing operations on October 29; Binance also notes that pausing withdrawals did not revoke malicious permissions already recorded on Ethereum (Binance incident report). The FBI attributes the intrusion to TraderTraitor / Lazarus; North Korea denies it (The Record) (earlier coverage) (discussion). · Threat Activity