▶ YouTube Summaries

← All summaries
theprimeagen#▶ Watch

Binance $6B hack via fake Homebrew ad and fake interview

2026-11-09 Mon ⏱ 15 min theprimeagen

A sarcastic news roundup of late-October 2026 crypto hacks: the Polymarket drain through a hijacked third-party script, the roughly $6 billion Binance theft attributed to North Korea, and a Ledger hardware-wallet supply-chain tampering. The central story is Binance: first described as a single compromised DevOps laptop, then revealed by Binance itself as a chain of a malicious Homebrew search ad, a fake job-interview program, abuse of an internal AI tool and a stolen container-deployment token. The host's recurring point is the absence of basic safeguards (pinned dependencies, multi-party approval of large transfers, least privilege) at organisations holding billions.

Polymarket

  • Prediction market (host: "one of the top five most degenerate places"), known for insiders betting on outcomes of their own companies.
  • Attack path: hackers took over the domain registrar of debugbear.com and repointed DNS. The DebugBear CDN script was swapped for malicious JavaScript that drained any Polymarket account into the attacker's wallet.
  • Host's criticism: Polymarket loaded the script straight from a CDN. It was not part of the build, not version-pinned, not cached, not integrity-checked, on a site holding user funds.
  • Polymarket promised to reimburse losses, but users who lost $10,000 or more had to sign a contract with ID check and a non-disparagement clause before being paid.
  • Side jab: a previous incident where a private key turned out to be trivially weak (host: "a private key of four").

Binance hack

  • Rumours of a Binance hack turned into an FBI letter: about $6 billion stolen, North Korea blamed. North Korea denies it.
  • Scale: the largest known hack ever, more stolen in a single day than in any prior incident. The host compares it to North Korea's roughly $26.6 billion GDP for 2025, about 20 percent in one day.
  • Binance managed to freeze about $3 billion of the assets. The host notes the irony that the promise of crypto is that nobody can freeze funds.
  • Laundering: mixers such as Tornado Cash tumble good and bad funds together. The attacker also made a "clean exit": minutes before the USDT freeze, deposited $60 million of stolen USDT into Aave as collateral and borrowed about 19,762 ETH, then left. The freeze hit Aave's money, not the attacker's.

Root cause: first version

  • Initial Binance statement: the incident may involve a compromised DevOps engineer's laptop.
  • Host's reaction: one laptop with access to systems holding billions is unbelievable. Joke: an unusually interested new girlfriend who loves Linux and C programming is a North Korean hacker.

Root cause: full chain disclosed by Binance

The host paused recording because new details were published, "even dumber" than the laptop story.

  • Step 1, supply chain :: wallet DevOps engineer A googled how to install Homebrew on a work laptop and clicked a sponsored ad leading to a tampered installer. Host: scam ads are a large share of ad revenue at big platforms (he cites ~8 percent for Facebook).
  • Step 2, social engineering (September) :: software engineer B was contacted on a legitimate job-hunting platform by someone posing as a project director, and ran a test program from the "interview" on a work laptop. The program rewrote the environment, among other things.
  • Step 3, 20 October, internal AI tool as springboard :: the attacker used B's machine and an internal AI tool to take control of DevOps engineer A and wallet software engineer C. A's machine held a container-deployment permission token.
  • Step 4, 29 October, about 05:15 to 08:00 :: the attacker logged into C's computer, used A's stolen credentials, deployed a container and triggered a malicious script that stole over $6 billion.

Host's takeaways

  • Never run software handed over in an interview. Before running any unknown program, ask an AI agent to scan it: whether it sends data out, reads or overwrites files, installs things. Host claims it would catch this immediately.
  • Missing controls: no review step for a transaction of that size (the "Todd from finance" check), a single engineer able to deploy a script that drains billions, no limits or delays on huge transfers.
  • Host admits he lacks all answers, but calls the setup "idiotic".

Bonus: Ledger hardware wallets

  • Claim: for several years hardware wallets were tampered with in transit, with extra hardware inserted. Typed private keys were recorded, and the attackers waited quietly before executing about $86 million of theft.
  • Host's conclusion: even a hardware wallet may be compromised, and entering a private key to move funds exposes it. "No winning in the world of crypto."
  • Mentioned in passing: Brazil and the EU also reported being hacked, and North Korea's "growth" compared jokingly to Anthropic's.

Sponsor

  • G2I: hiring service with 8,000+ pre-vetted engineers (front end, back end, AI), 7-day free trial and $1,500 off via the Prime link.