Poor headline.
It began in June when an employee on Binance’s wallet developer team thought they’d indulge in some vibe coding by installing a popular AI coding tool. But they ended up downloading a tampered installation of Homebrew, a tool that’s popular with software engineers, after clicking a malicious ad.
There’s lots of packages on Homebrew and it’s a popular package manager, even outside of MacOS. He could have decided to grab anything from Homebrew and get hit.
The real one to blame here is Google for doing zero vetting on the crap they put at the top of the search results. Malicious ads for popular software happen constantly and so far they haven’t moved an inch to fix it.
If you touch computers enough to install homebrew you shouldve touched computers enough to find the real download link, or at least install ublock.
100% user error.
If you work (as in LITERALLY GET PAID TO DO SO) back/front end, IT or devops there’s absolutely no excuse to expose your digital self like an absolute fucking idiot not checking where the fuck are you & what the fuck are you running.
And specifically for crypto, it’s negligent to not put billions in a multisig wallet.
But Macs don’t have viruses!
Technically not a virus.
futurism .com links often seem like clickbait for people who are skeptical of the broligarchy.
- It Turns Out Binance’s $6 Billion Hack Happened Because Its Employees Were Vibe Coding
- Anthropic’s IPO Is Cratering
- Kids Hooked on AI Chatbots Are Showing Dramatically Worse Mental Health: They’re turning to AI chatbots for help, but their machine confidantes are doing more harm than good.
- Former Meta Exec Shreds the Company’s Muse AI Agent as “Insane” Privacy Risk
I’m all for covering that side of the story - we need a lot more resistance against the oligarchy. But clickbait is sleazy no matter what story it’s pretending it can tell.
Sleazy propaganda is sleazy propaganda even if it’s in my favor.
Yeah, Futurism’s presentation is always overly dramatic and clickbaity. I end up learning more by clicking on the embedded links in the articles than the articles themselves.
I agree - they do usually cite their sources well, even if they are presented in an over-the-top fashion. I appreciate the citations.
If you are developing software with financial impact, and every developer downloads their dependencies from the internet without further checks, you already have set up yourself for desaster.
If you would ask a LLM for how to guard yourself against malicious dependencies, this would be one of the first things they’d point out.
Also crazy how they are just allowed to “indulge” themselves with vibecoding on a machine that can access live production servers.
Yeah, just doing shit without worrying about things like security is a core part of vibe coding. Vibecoding as a concept put into practice is definitely to blame.
If you don’t know enough to write the code yourself, you likely also don’t know enough to ask the right questions
The person to blame is the idiot clicking on ads for software downloads
If we blamed every low level individual idiot who falls for malware, we’d be here all day and the malware would still be there. How about we blame the people pushing malware to millions of idiots? Also the companies who can’t even employ the most basic cybersecurity best practices to protect their own assets. It’s not like they were a small startup that can’t afford to.
Blame should be shared. It’s not a full sum game. It’s a failure of every part.
Yeah but a secure system should have stopped them. And even if that first safety net failed another one should have stopped the hackers from accessing the client’s crypto accounts. Why does a software dev’s computer need access to the live accounts.
Also why can they just access any website? Shit should’ve been locked down. They should’ve only be able to access whitelisted websites.
I’ll still blame the corporation gaining god knows how much money with this over the individual person, even if I also think a Developer should have known better.
But who downloads homebrew from the web and not CLI?
Vibe coders
Thats precisely my point, yeah. Or some PM who thinks they’re a Dev now
Thats something I would absolutely do years ago before I got more familiar with cli and not as afraid of a terminal shell
Are you a Dev though?
Oh hell no I dont even know computer
Bold of you to blame google, a malware company, for advertising malware.
Yea, futurism.com is a shitty rag that will say anything for money.
He took a job interview on his work machine from a fake company that was actually the NK hacking group and was convinced to download the payload.
Beyond stupid to take an interview from your current employers machine.
I’m a school bus driver. Some of my coworkers recently tried putting tape over the on-bus cameras so they could get away with vaping and smoking and using their phones while driving. The stupidity required to think they could get away with this is mind-boggling. 1) They thought it would actually work in the sense that our bosses would not notice that the camera was not recording anything, and 2) they thought if it was detected that our bosses wouldn’t know it was them that put the tape up. Turns out the cameras are recording even when the buses are turned off and the little red light isn’t on.
I’m naturally opposed to the surveillance state, but I wouldn’t want to be taking action on this principle just so I could fucking smoke and use my phone while driving a school bus. Amazingly, my coworkers got nothing but a warning for this, and then we all got a sternly-worded letter telling us not to fuck with the cameras.
Frankly, I’m horrified at the idea of someone with so little self-preservation that they would turn off the security cameras in a school bus. The person that camera most helps is the bus driver.
I work as a substitute teacher, and frankly I WISH we had cameras in the classrooms. The horror stories I’ve heard? Kids are not above making false allegations against teachers they don’t like. Hell, groups of them will collude to do so to bring down a teacher they don’t like. Some kids a are just psychos. (Or more charitably, they simply haven’t morally matured.)
I’ve been lucky to not have this happen to me, but sometimes kids will just straight-up lie to cover for their own bad behavior, or to get back at a teacher that dared to discipline them. With regular teachers, they usually have enough protections to require a formal investigation. But with substitutes? Often schools or districts will just fire a sub and not think twice of it, even when an allegation is completely ridiculous. It’s easier to make the sub disappear than to thoroughly investigate a claim.
I WISH I had cameras in my classrooms. As a substitute, it would allow the teacher to directly see the kind of behavior their kids engage in while away, and to discipline the troublemakers accordingly. For regular teachers, it would both prevent false allegations and also prevent litigious parents of disruptive students from working the system. Plenty of parents think so little of teachers that they will believe a lying 6th grader over an adult, trained, and licensed teacher.
I wouldn’t feel any lack of privacy as a teacher from having cameras right in the classroom. I already have to deal with many eyes on me all day long. I work every day knowing I have to be careful with what I say or how I act.
I can understand why the students wouldn’t want cameras in the classroom. The bad kids don’t want accountability and everyone wants a little privacy. But for the school employee? It’s baffling to me why you wouldn’t want your workplace recorded. One false accusation can ruin your entire career.
The person that camera most helps is the bus driver.
No, the person that camera helps the most is the one that sells footage to AI companies for training data.
I hear you, its very bad you need to think about this, nothing justifies cameras in the classroom. or on the bus. no companies can be reasonably trusted with handling the recordings and the access responsibly. none of them do that, everyone is going for the cheapest sloppiest solution, not caring for if the recordings are uploaded to a company dealing in even facial recognition database development.
I hear you, its very bad you need to think about this, nothing justifies cameras in the classroom. or on the bus. no companies can be reasonably trusted with handling the recordings and the access responsibly. none of them do that, everyone is going for the cheapest sloppiest solution, not caring for if the recordings are uploaded to a company dealing in even facial recognition database development.
Addiction causes the brain to convince itself of the craziest nonsense.
I think it’s hilarious that the drivers thought kids wouldn’t gossip about the bus driver vaping. 😄
Do they not remember how fast stories about teachers fly through student bodies?
AFAIK they’ve never vaped on the bus with kids aboard, they do it when it’s empty or parked. I have seen them many times using their phones with kids aboard, though. There’s one driver that I never saw without her phone in one hand when I passed her; she was friends with the old transportation director so she was able to get away with anything, although the new director I think is trying to get rid of her. This driver hit two cars in one day and somehow still has her job.
This driver hit two cars in one day and somehow still has her job.
That seems borderline impossible but here we are in the age of zero accountability and madness.
She wasn’t even suspended, although after this the director instituted a policy of a week’s suspension if the accident is your fault and you have to undergo mandatory re-training. Pretty amazing that we had no such policy prior to this.
I was a school bus driver for a while. The company sucked and I hated them. I vaped in front of the camera (only on an empty bus) and no one said anything.
The company
I think that’s your problem. Private school bus companies don’t give a fuck about anything, including (especially) their employees and whatever bullshit they get up to. Working for a school district that operates its own buses is the only way the job can be decent, although that’s a crap shoot. My district pays great (nearly $35 an hour) and provides excellent health insurance and even a pension if you survive ten years. Other districts in the area pay less than $25 per hour and provide no benefits.
Damn. That’s way better than what we have here. (this is in Canada)
There’s 2 school boards in my city and about 5 school bus companies who bid on routes.
They literally pay minimum wage with no benefits or anything.
I only did it because I was transitioning careers from driving trucks during the pandemic and nothing was happening in my chosen industry
You’d think they would have a really hard time attracting talent at those rates in a place with legal weed.
It’s mostly immigrant wives and retired people working there, all trained in the last 6 months most likely
Just looked up Canada’s minimum wage. That is fucking terrible and yet still nearly twice the US minimum wage. Paying that for someone with a CDL is nuts. Even if it doesn’t require a CDL in Canada it’s still fucking nuts. Did you at least get 8 hours a day?
Oh fuck no.
I took on the “spare driver” role which paid $120/day because I was getting switched around all the time. The drivers on regular morning/afternoon run only got $90.
They say you’ll make $22 because “the routes only take an hour” 😳. Some routes that was true for, but not most of them.
So, minimum wage is $15/hr in our province and labour laws state that a split shift must pay a minimum of 3 hours per shift. So a minimum of 6 hours daily. Divide $90 by 6 and they’re paying $15/hour.
They’re always short drivers here, and are constantly training because of a 250% turnover rate. It’s ridiculous.
I wonder if Binance has a similar work culture to FTX
FTX were a bunch of kids that had zero experience managing risk through down markets that overextended themselves. Binance let their guard down in an escalating cyber security risk environment. It’s a different kind of stupid.
If they were a smart person they wouldn’t be working at a fake bank in the first place.
I have not yet heard what happened after the payload was delivered. It’s also beyond stupid that one engineer’s laptop apparently had the credentials to shift $6 billion.
Wasn’t as simple as creds on the machine. Good write up: https://www.theregister.com/security/2026/11/03/north-korean-fake-job-interview-led-to-63b-binance-heist/5307398
The headline makes it sound like vibecoding was the main part in this, but in the text they describe an elaborate social engineering scheme that compromised the laptop.
"The engineer was asked to complete and download an “assignment” that contained malicious code that instantly executed once the employee began installing it. Among the things it changed was replacing a real development tool with a malicious version that could communicate with the hackers and execute commands.
That all took place in September. Starting in October, the hacker used the compromised employee machine to leverage an internal AI tool and use it as a “springboard” to seize control of the computer and the computer of a third wallet developer. "
I am a self-described “AI hater” but as far as I can tell the headline is just a straight up lie.
Hackers gained access to and exploited an AI tool, which has nothing at all to do with vibecoding employees.
But maybe in misunderstanding something…
They want to blame AI but realistically it comes down to human error. Cyber security is more about sociology than it is about technology.
An argument could be made that someone untrained (many vibe coders) shouldn’t be in positions that would fall for this. A stretch, but still valid.
Just wait until a generation is raised on AI and never has to think hard or critically in their life. They will be so easily exploitable.
Ahh, but the AI will be so smart they will thwart the hackers (and the hackers will have been leaning on AI for so long they won’t be able to break through)
/s (kinda? Lol)
The actual argument here is just comon sense really- don’t do private stuff on a work machine!
They didnt?
True and I wonder if all the LLM‘s will take this vector over? I mean they study all texts, behaviors, and human interactions.
They do not study.
It can, but it would be the underlying technology not any of the out of the box chat llm versions. Realistically, it would be easier to monitor for device tampering, like downloading an unapproved software, than correlating the human behavior.
It makes sense that the kind of people who vibecode would fall for this :P
deleted by creator
Sounds like social engineering had a greater impact on this incident than vibe coding did.
Consider the overlap between people who take a chatbot at it’s word all day and people susceptible to social engineering.
Everyone saying what a stupid obvious mistake it is assumes 1. There has ever been a fishing test where you can successfully get everyone in the company to not click the link that says “DONT CLICK THIS LINK” 2. Any dev that’s graduated since 2022 has had any proper training on package vetting/security hygiene/anything basic at all. The degree is now “just try to get the vibe code to compile.”
Yes it’s a stupid obvious mistake. Welcome to the modern world.
There were never hacks before as we all know.
Awesome story actually if you have a minute to read through. Sounds like it would be very technical but the details are easy to follow
Getting socially engineered with AI slop and then downloading some random shit on your work machine is just humongously stupid. I wouldn’t want to be in the skin of that engineer right now
Dude should never be allowed to touch a computer again. How do these people get hired? He Googled “homebrew,” clicked a fucking ad, landed at the page in the screenshot, then ran that insanely obviously suspicious terminal command to “install” it. Are you joking.
What the fuck? I did that when i was like 13. If someone wrote this as a story, no one would believe it, because its too stupid, but fucking hell, reality is dumber than fiction.
I agree with you, but unfortunately “just run this command” is how the brew page works, so mac users are trained to just do that, and I can believe they did it without looking (although that command would have me asking questions as well) -
I got a Captcha on some search result a few weeks ago that initially looked legitimate then came up with this.
It had put obfuscated code on my clipboard to download and run an executable.
Holy crap! That’s wild.
This is partly on software devs these past 10-15 years. They’ve gotten so much lazier when it comes to making their software easy to install. Legitimate software often ends up having a 10-long list of instructions to install it.
would such incompetence not invalidate insurance? at least significantly complicate claim?
I did some consulting work once for a bitcoin custodian. I learned that their insurance did not cover bitcoin in cold storage.
How is it that wallet developers had access to customers crypto? This seems like bad security and a breach of trust.
These big brokerages offer wallet services. And need wallets of their own to store what’s being held/traded on their site. Someone has to maintain that stuff.
you know. I’ve worked at large corporations that were required to be HIPAA and PCI compliant. the big database with millions of records of sensitive information was limited access. who had access to it?
- the application
- the DBAs who managed it
- me, who managed the application and was backup for the DBAs
not even the execs had access to it.
my point is, it sounds like they aren’t following compliance requirements and should probably face a class action suit at the least.
Yeah i write financial software now and we’re PCI compliant. Devs can’t access prod or its very limited and read only with no access to encryption keys. Those who do have prod access, don’t have write access to the code. No one has both.
All software installs on any company device are reported to ops.
I’m not saying this couldn’t happen but i think it would be way more difficult. Also, we’re a company of 15 people.
Holy shit y’all are desperate. Your characterization is basically a straight up lie at this point. Anti ai propaganda is rotting your brains.
June when an employee on Binance’s wallet developer team thought they’d indulge in some vibe coding by installing a popular AI coding tool. But they ended up downloading a tampered installation of Homebrew,
Its a shame liable laws are so weak in the US.
Libel
🤷
Yeeeeeeees! All those “programmers”. Fuckwits that know nothing, just follow idiotic prediction algorithms.
Clearly see the title and get filled with rage, huh?
Read the fucking article.
It was a very sophisticated social engineering hack and nothing to do with “vibe coding”.
It has everything to do with blindly following algorithms though. Guy clicked on a malicious ad after searching for something and trusted it blindly. So the poster is actually mostly right.
Idk how sophisticated it is if it counts on an engineer being dumb enough to click a Google ad. Lucky, maybe.
Being head-hunted through linkedin, multiple interviews and even having the CEO on whatsapp, thinking you might have something better to do than work for a shitty crypto company somehow makes this person… dumb? Opening the assessment on a work machine, now THATS dumb.
Yes, not doing due diligence on a recruiter and company is dumb.
Downloading an unapproved program on your work station is dumb.
Not putting it in a sandbox is dumb.
This dude was dumb, at least at this specific moment in time.
🤡🤡🤡🤡🤡🤡🤡🤡🤡
The problem with your position is that this guy was, in fact, a moron.
I love how all of you think you’re invincible against a dedicated hack and phishing against your companies. Like peak fly to close to the sun bullshit. The arrogance is just comedic gold.
This was a highly organized scheme using targeted ads.
Which is why I’m stuck having to watch training videos on exactly this shit every other month. And my company sends out fake phishing emails regularly to test for people doing this.
And our workstations don’t allow us to install shit
🤷 security is hard
It was to expect.
Someone was bound to introduce some “AI slop” & “Vibe coding” bashing into this case — true or not.
What took them so long?
… did you even read the article? Its not really bashing if it’s true
Its not really bashing if it’s true
So I’ve never had a true chance to bash trump? 😰
Imagine being this stupid. Jesus dude. Reading is fundamental.
It happened bc people hacked them. No hacking, no hacks. Hackety hack hack, stop it!
No fucking shit
