Google search malvertising is how several outlets frame the start of Binance’s largest crypto theft to date, which The Verge put at $6.3 billion after an October 29 attack. The exchange’s postmortem does not name Google or a paid placement; The Verge says a tampered installer was apparently spread by a malicious Google ad, while 9to5Mac says Binance only said “a search engine.” That June download, then months of fake hiring, preceded the theft.
Key Takeaways
- Outlets link a June search ad to a tampered Homebrew download.
- FBI identifies North Korea’s TraderTraitor; fake interviews came next.
- Theft reported at $6.3 billion; about $2.85 billion frozen or intercepted.
- Teng: 98% of impacted tokens replenished then; 2% still being completed.
How outlets describe the search lure
AdTechRadar reports an engineer clicked a malicious Google Search ad in June and downloaded a compromised Homebrew installer, a popular Mac developer tool. It does not call that person a Wallet engineer. AdExchanger said a Binance Wallet DevOps team member downloaded a malicious copy from a mirror site promoted in a search ad. The malware was spotted, but not before hackers had the real identities of Wallet DevOps staff. The Verge says security detected that first install and replaced the worker’s device.
9to5Mac says a DevOps engineer working on Wallet searched for an AI coding tool and downloaded a malicious clone of the Homebrew installer in Google Search. The outlet notes Binance’s wording was only “a search engine” and could not confirm a sponsored slot. Published malware targeted /opt/homebrew, where Homebrew lives on Apple silicon, which 9to5Mac reads as an M-series MacBook. Binance never said “Mac.”
A fake interview, then an internal AI tool
The FBI has identified the attackers as a North Korean unit dubbed TraderTraitor, The Verge reported. The June install exposed details about the engineers and how they work. In September another engineer was targeted by someone pretending to be interested in hiring them.
The Verge says that person set up calls, ran multiple interview rounds, shared social media pages to build trust, and prompted a fake assignment that was malware. AdExchanger described a prolonged fake job interview that put the assignment on a work device. Endpoint tools missed the second attack. The attacker deleted the pyenv executable, replaced it with a malicious version, and gained backdoor access.
By October 20, TraderTraitor used Binance’s internal AI tool to gain control over wallets for the June victim and a third employee. On October 29 the attackers logged into that third computer and launched the theft. The Verge, citing the postmortem, said the malware used obfuscation, communicated with an attacker-controlled server, and that the attacker concealed the activity. Binance says it has prevented 57 suspected North Korea-linked cyber threat cases.
The $6.3 billion theft and what was frozen
Reported theft totals do not match across outlets.
| Item | Figure | Reported by |
|---|---|---|
| Theft | $6.3 billion | AdTechRadar, The Verge, 9to5Mac |
| Theft | $6 billion | AdExchanger |
| Frozen or intercepted | About $2.85 billion | Richard Teng, via The Verge |
| Frozen | About nearly $3 billion | 9to5Mac |
| Impacted tokens replenished | 98%, with 2% still being completed | Richard Teng, via The Verge |
The Verge reported that CEO Richard Teng writes no user is bearing the loss, with about $2.85 billion in stolen assets frozen or intercepted. The Verge quoted him:
At this moment, 98% of impacted tokens had been replenished; we’re completing the remaining 2%. Withdrawals have broadly resumed.
The postmortem also explains why Binance was not able to stop the transactions that occurred nearly two hours after the first unauthorized transfers. The hot wallet used multi-party computation, so there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations.
What the reports mean for search buyers
The installer lure is not new. 9to5Mac previously reported fake Homebrew ads at the top of Google Search pushing Atomic Stealer to Mac users in early 2025.
AdTechRadar also cites a separate case. It says Citizen Lab researchers revealed last month that Israeli advertising agency Discover-Tech distributed surveillance-related ads across more than 120,000 websites and 75,000 apps, potentially reaching hundreds of millions of people. Separate reporting on this site has tracked Discover-Tech surveillance ad bids.
AdTechRadar notes Meta has faced scrutiny this year over scam ads on its platforms. AdExchanger noted a recent rash of Google ad account takeovers.
- June: a tampered Homebrew install via search; device replaced, staff identities already exposed.
- September: fake interviews put malware on a second engineer’s work machine.
- October 20: an internal AI tool used to reach wallets for the June victim and a third employee.
- October 29: attackers log into a third computer and launch the theft.
AdTechRadar argues platforms are not doing enough, that regulation will likely need to curb scam ads, and that AI makes it easier to disguise malware as legitimate ads.
