On 24/03/2026, seven months before the $6.34 billion theft, the Mac's browser reached a page reported that day as a fake Homebrew installer through a Google ad, and a stealer was running 16 seconds later. Binance says its compromised Wallet DevOps engineer downloaded a tampered Homebrew after a web search, in June. This log does not match the chain Binance has disclosed, but it exposes enough to matter.
Binance is named because the incident and its initial findings are public. The data comes from Constella Intelligence. The potential employee is anonymized: email, username, name, IPs, serial numbers, tokens and passwords are masked, and third-party organizations are described generically. Every statement comes from the log or from a cited public source, and each piece of evidence is labeled with its basis. Raw excerpts are verbatim apart from the redactions; cookie expiry dates are nominal, as a server may have invalidated a session earlier.
The log belongs to a potential Binance employee and was captured seven months before the 29/10/2026 theft.
The potential employee's browser reached macdev[.]slab[.]com from a Google ad at 22:47:36 UTC on 24/03/2026. That same day, Homebrew's GitHub received a report of a sponsored page on that domain offering a fake "install brew" command. The stealer's AppleScript started 16 seconds after the click and was the frontmost app when the capture finished, at 29 seconds (Mac clock at UTC+8, the time zone its browser recorded). The command itself is not recorded.
The log does not match Binance's Engineer A. Binance dates that infection to June 2026 and places the engineer in Wallet DevOps; this log is from March and holds no wallet or Wallet DevOps systems.
| Corporate account | [redacted]@binance.com |
| Device | MacBook Air M3, macOS 15.5 |
| Capture | 24/03/2026 22:48:05 UTC |
| Days since capture | 232 (to November 11, 2026) |
| Exposure | Critical |
The exposure is critical. The Okta password is a variant of the Mac login password, from a family used in 334 of 545 saved credentials. The log holds credentials for 14 toolsfdg[.]net data-platform hosts (Kibana, Airflow, Kafka, Zeppelin, Git) and passwords for 15 other corporate email accounts.
There is no evidence that this log was used in the attack.
What Binance has disclosed, quoted from its initial report and cross-checked with The Hacker News and SafeDep
On 29/10/2026 an attacker moved about USD 6.34 billion out of Binance's hot wallets through its internal wallet-signing service (Binance's figure; press reports range from USD 6.3 to 6.43 billion). Binance's initial report, published on 03/11/2026, cites FBI information that North Korea (DPRK) is responsible, and describes a chain that starts on engineers' laptops.
"Downloaded a tampered Homebrew installation in order to install a popular AI coding tool", "after searching for it on a search engine". Binance "detected the anomaly, replaced the device, and rotated all related credentials".
Approached on a job platform by someone "posing as a Project Director". The interview assignment replaced a development-tool component (pyenv under /opt/homebrew, i.e. a Mac, per SafeDep).
From Engineer B's computer the attacker "used an internal AI tool" to take control of Engineers A and C, and found that A "had a container deployment permission token".
The attacker logged onto Engineer C's computer, deployed a container with the stolen credentials and used the signing service to move funds outside the normal withdrawal flow (20:05–23:56 UTC, per SafeDep).
This incident may predate the one Binance has disclosed, or it may simply be unrelated to it. This research is for educational purposes only. The chain above comes from Binance's statement.
The data comes from Constella Intelligence: one infostealer log from a potential Binance employee's MacBook Air
| Source | Constella Intelligence |
| Malware family | Matches MacSync's documented artifacts (/tmp/sync<digits> staging folder, zsh → osascript chain, per Huntress); the log does not name the family |
| Capture time | 25/03/2026 06:48:05, Mac local time, which is 24/03/2026 22:48:05 UTC at UTC+8, the time zone the browser recorded |
| Unique credentials | 532 (149 distinct passwords, 365 services) |
| Cookies | 865 (655 nominally valid at capture; 57 nominally valid as of November 4, 2026) |
| Google OAuth tokens | 3 |
| Other | Keychain (19 items, including "Chrome Safe Storage"), 3 iCloud entries and the Mac login password |
The cybercriminals signed 14 cookie values and 4 Keychain values with references to the channels where they published the data, which makes the log harder to analyze. None of the evidence below relies on those values.
[redacted]@binance.com · MacBook Air · captured 24/03/2026
A potential Binance employee whose saved credentials reach data-platform tools on toolsfdg[.]net. The browser reached a fake Homebrew page from a Google ad, and a stealer was running 16 seconds later. Exposure critical: predictable Okta credentials, 14 data-platform hosts and passwords for 15 other corporate email accounts, 232 days after capture.
| OS | macOS 15.5 (24F74), released 12/05/2025; 15.6 had been available since 29/07/2025 |
| Hardware | MacBook Air M3 (Mac15,12), 16 GB |
| Hostname / user | [redacted] / [redacted] |
| Time zone | Asia/Taipei (UTC+8), as recorded by the browser in its cookies (Evidence 3) |
| IP / country | IP of the Mac in the log: 25.140.x.x. The country is not recorded |
| Running at capture | Family Sharing processes, Minecraft, Spotify, LINE and ChatGPT; Activation Lock on. Two Chrome profiles: Default (the @binance.com credentials) and Profile 1 |
| Security agents | None in the process list (no EDR, MDM, VPN or Okta Verify process) |
The log holds no browsing history, but several cookies carry their own timestamps. They line up with a public report filed the same day.
| Time (UTC, 24/03/2026) | Event | Evidence |
|---|---|---|
| 22:46:58–22:47:26 | Session on chatgpt.com | _ga_9SHBSK2D9J, cf_clearance, _dd_s (created=1774392446419) |
| 22:47:35 | Lands on Slab from a Google ad | _gcl_gs (i1774392455); Slab analytics session 1774392455, session number 1 |
| 22:47:36 | Google click ID stored; macdev.slab.com loaded | _gcl_aw = GCL.1774392456.Cj0KCQ…; two GCLB cookies for macdev.slab.com |
| 22:47:37 | Last analytics hit on Slab | _ga_0N8WXQ2HKZ (t1774392457) |
| 22:47:52 * | osascript starts (frontmost app at capture) | lsappinfo: 49) "osascript" … (in front) |
| 22:48:05 * | Stealer collecting data | sh -c ps ax > '/tmp/sync1014991/SystemInfo/processes.txt' |
* The log records these two times on the Mac's clock (06:47:52 and 06:48:05 on 25/03) without an offset. They are converted at UTC+8, the time zone the browser recorded in its cookies (Evidence 3).
| Cookie | Value field | Decodes to (UTC) | Expiry (UTC) |
|---|---|---|---|
_gcl_gs | $i1774392455 | 24/03/2026 22:47:35 | 22/06/2026 22:47:35 |
_gcl_aw | GCL.1774392456.<click ID> | 24/03/2026 22:47:36 | 22/06/2026 22:47:36 |
_ga | ….1774392456 | 24/03/2026 22:47:36 | 28/04/2027 22:47:35 |
_ga_0N8WXQ2HKZ | s1774392455 · o1 · t1774392457 | Session 22:47:35 · session number 1 · last hit 22:47:37 | 28/04/2027 22:47:37 |
GCLB ×2 | Load-balancer token (value altered) | — | 24/03/2026 23:47:34 and 23:47:36 |
_gcl_aw and _gcl_gs. Here _gcl_aw holds a click ID on slab.com. Confirmed in the log_gcl_gs, _gcl_aw and the Slab analytics cookies decode to 22:47:35–37 UTC, and the _gcl_aw expiry is exactly 90 days later. o1 is the session number: the first Slab session recorded in that profile.GCLB load-balancer cookies show the browser loaded macdev.slab.com, one of them under the path /posts. Their values contain an inserted string, so only their name, path and expiry are used.The log contains the domain, not the page, its full URL or the command. Those are documented in a public report filed on Homebrew's GitHub the same day.
The log records the stealer's times on the Mac's clock without an offset. The browser recorded its time zone in several cookies.
tz=Asia.Taipei, and six consent cookies in both Chrome profiles store the browser's local time as GMT+0800 (Taipei Standard Time), between March and June 2025. Confirmed in the logzsh → osascript, with no terminal attached (??) and at low priority (SN), wrote its process list into /tmp/sync1014991/. Huntress documents MacSync's "randomised staging root, /tmp/sync<random>/" and a zsh loader that pipes the payload "straight into osascript". Matches Huntress's MacSync documentationdscl . authonly. Password: confirmed in the log| Statement | Status | Basis |
|---|---|---|
| The browser reached macdev[.]slab[.]com from a Google ad | Confirmed in the log | Click ID in _gcl_aw on slab.com at 22:47:36 UTC, first Slab session |
| That page served a fake "install brew" command | Confirmed by a public source | Homebrew discussion #6770, same day and domain |
| The Mac's clock was on UTC+8 | Confirmed in the log | tz=Asia.Taipei and GMT+0800 in the browser's cookies; no larger offset fits the ad cookies |
| A stealer was running 16 s after the click | Confirmed in the log | osascript started at 22:47:52 UTC and was in front at capture; staging at 22:48:05 UTC |
| Its artifacts match MacSync | Matches public documentation | /tmp/sync<digits>/ staging and zsh → osascript chain, as documented by Huntress |
| The Mac login password was stolen | Confirmed in the log | Password field in Information.txt |
| The exact URL path or command run | Not in the log | No browser or shell history; Terminal was not running at capture |
| The potential employee is Binance's Engineer A | Not supported | Binance dates Engineer A's infection to June 2026, in Wallet DevOps; no wallet systems in the log |
The Mac's browser reached a page reported that day as a fake Homebrew installer, from a Google ad, and a stealer with MacSync's artifacts was running 16 seconds later. Binance's statement, The Hacker News and SafeDep describe Engineer A's infection as a tampered Homebrew download after a web search; none of them mentions an ad. This log is from 24/03/2026, three months before the June date Binance gives for Engineer A.
57 Binance-linked credentials, a predictable password family and passwords for 15 other corporate email accounts
57 unique credentials (61 records), almost all in the Default Chrome profile. toolsfdg[.]net hosts the data-platform tools these @binance.com accounts log into (Kibana, Airflow, Zeppelin, Jupyter, Hue, Git). Several account names and paths refer to Risk, such as risk/ds_sagemaker_model.
| Service | Creds | Accounts | Password |
|---|---|---|---|
| binance.okta.com (production SSO) | 2 | Own, plus a full-width-character variant of the username (3 records) | 8 chars, 4 classes. Variant of the Mac password |
| binance.oktapreview.com (Okta preview tenant) | 2 | Own | 8 chars, variants of the same family |
| Google (@binance.com account) | 1 | Own | Same family |
| Kibana (2 production clusters and 1 private IP on port 5601) | 20 | Own, 14 other corporate emails and 3 non-personal | Own: 16 chars, also used on the internal Git and the NAS. Other corporate emails: 11 different 15-char passwords and 3 with the same 9-letter password |
| Airflow (5 instances) | 6 | A read-only account and 2 other non-personal accounts | Read-only: 8 chars, the same on 4 instances; the others: 16 and 20 chars |
| Kafka Manager | 1 | Read-only | 16 chars, 4 classes |
| Zeppelin (2 ports) | 4 | 4 non-personal accounts | 3 share one 18-char password |
| Jupyter, BDP portal, Hue and Nebula Graph | 5 | Own, admin and root | Hue: 5 chars, in 5 records; Nebula: 6 chars |
| Internal Git (git.toolsfdg[.]net) | 1 | Own | 16 chars, the Kibana one |
| QA Elasticsearch (internal AWS load balancer, Tokyo) | 1 | Another corporate email | 8 chars, 1 class |
| Service on port 3377 (localhost, a private IP and a public IP) | 3 | Non-personal (5 records) | The same 9-letter password |
| DataVisor (anti-fraud vendor, 3 consoles) | 3 | Own | 2 from the Mac password family |
| SuccessFactors and Bupa Global (HR and health insurance) | 2 | Own | Mac password family |
| SaaS with the corporate email (JetBrains, Figma with a misspelt domain, applyweb) | 4 | Own | Figma: Mac password family |
| Synology NAS (QuickConnect) with @binance.com identities | 2 | Own and another corporate email | Own: the Kibana one |
Profile 1 also holds 5 AWS console credentials, three of them for one IAM user, on regional and global sign-in pages. The Default profile's autofill holds 2 AWS account IDs and an account alias. Binance should confirm whether these accounts are its own.
Unique credentials per category, 532 in total. Full list in the appendix.
The four Okta passwords follow the same pattern as the Mac password. The 9-letter lower-case password appears in 20 records: three other corporate Kibana accounts, the port-3377 service (5), a TP-Link DDNS address (4), local and private addresses (6) and dstool.net (2).
No cookies for binance.okta.com, toolsfdg[.]net or AWS. The 20 binance.com cookies belong to the public website and have expired.
One in the Default profile, two in Profile 1. SID cookies nominally expire on 28/04/2027 (Profile 1) and 26/09/2026 (Default). Refresh tokens and SID cookies give access to the Google account until they are revoked or expire.
1,882 entries, with 12 @binance.com addresses (own plus 11 others), 2 AWS account IDs and 45 IP addresses, two of them in private 10.x ranges. URLs for Jira (project RM), Confluence, Spade batch jobs and a Risk Airflow repository on the internal Git.
Including "Chrome Safe Storage". The 3 iCloud entries belong to the Mac password family. Other sessions: Grammarly (grauth, to 24/03/2027); ChatGPT and GitHub without a session token.
Profile 1 holds logins to three other organizations: a bank, a media platform and a hospital. It also holds credentials for a Synology NAS reachable through QuickConnect, 3 DDNS names and router admin pages.
Nothing in it links it to the chain Binance disclosed, but it deserves a review with Binance
The log holds none of the artifacts Binance describes (a container-deployment token or an AI-tool session) and no wallet or Wallet DevOps systems. It shares the technique Binance describes for Engineer A, a tampered Homebrew; here the page was reached through a Google ad.
| Mac | Yes (MacBook Air M3) |
| Tampered Homebrew | Google ad → page reported as a fake Homebrew installer → stealer with MacSync's artifacts 16 s later |
| Date against Binance's chain | 24/03/2026, three months before the Engineer A case |
| Systems in the log | Data-platform tools (Kibana, Airflow, Kafka, Zeppelin, Git) |
| Wallet or Wallet DevOps systems | None |
| Okta credential in cleartext | Yes, a variant of the Mac password |
| Okta session captured | No |
| Container-deployment token | No |
| AI tools | Yes: 19 credentials for AI services and a ChatGPT session in the log |
| Colleague data | 15 other corporate email accounts with passwords |
| Data-platform hosts | 14 toolsfdg[.]net hosts with credentials, 17 named in the log |
| Sessions still nominally valid | Google, Grammarly |
| Captured before the attack | Yes (24/03/2026) |
| Days since capture (to November 11, 2026) | 232 |
| Fit with the disclosed chain | Partial: same technique, different date, no wallet systems |
| Exposure | Critical |
The log holds 15 other corporate email accounts with passwords, and credentials for 14 of the 17 toolsfdg[.]net hosts it names.
It is not known whether Binance rotated them after March. Airflow and Zeppelin passwords repeat across instances and accounts, and the four Okta passwords share the Mac password's family.
Binance dates Engineer A's infection to June 2026. The traces in this log (a Google-ad landing on a fake Homebrew page, /tmp/sync staging, binance.okta.com credentials) define what to search for in Constella Intelligence data.
Services with a saved credential in the log, counted by category. Service names, usernames and passwords are not reproduced. A service can appear in two categories if it was used with both the corporate and a personal identity.
| Category | Services | Credentials |
|---|---|---|
| Binance – corporate | 32 | 57 |
| Binance – customer account | 2 | 6 |
| Third party: bank | 7 | 7 |
| Third party: media platform | 31 | 36 |
| Third party: hospital | 5 | 7 |
| Cloud and infrastructure | 29 | 32 |
| Development and code | 14 | 23 |
| AI | 16 | 19 |
| Crypto and web3 | 8 | 10 |
| Banking, payments and tax | 9 | 12 |
| Identity and email | 14 | 25 |
| Collaboration and productivity | 31 | 41 |
| Social media and messaging | 18 | 26 |
| Training and jobs | 33 | 37 |
| Consumer, health and other services | 68 | 83 |
| DDNS, NAS and router services | 12 | 23 |
| Servers by public IP | 9 | 15 |
| Leisure, gaming and adult content | 5 | 6 |
| Private IP addresses | 22 | 56 |
| System (macOS) | 1 | 1 |
| Other | 4 | 10 |
As of November 4, 2026, 57 cookies had nominal expiry dates in the future, across 7 domains: google.com (35), google.com.tw (9), youtube.com (4), chatgpt.com (4), slab.com (2), grammarly.com (2) and doubleclick.net (1). This is the November 4 snapshot, not a revalidation of session access on the publication date.