Binance's $6 Billion Heist Started With One Poisoned Search Ad

A single click on a search ad cost Binance $6 billion. The cryptocurrency exchange published a preliminary post-mortem of last week's heist, which investigators suspect was a North Korean operation. The entry point was not a sophisticated network breach. It was malvertising (malicious advertising that promotes poisoned copies of legitimate software).

A Binance Wallet DevOps team member downloaded a counterfeit copy of Homebrew, a popular open-source package manager, from a mirror site promoted through a search ad. Binance detected the malware. The hackers had already obtained the real identities of Wallet DevOps team members.

How did the attackers move from one laptop to billions?

The North Korean hacking unit spent months running covert schemes against the wallet team. One scheme was a prolonged fake job interview. It lured a Binance DevOps engineer into downloading an "assignment" onto a work device.

Once the hackers controlled that engineer's laptop, they used an unnamed internal AI tool to log in to other engineers' devices. With multiple credentials in hand, the heist went through. The mechanism is simple: identity theft plus social engineering plus lateral movement inside the corporate network.

The bill: $6 billion. The lesson for marketers is that a promoted search result can be the cheapest weapon in an attacker's arsenal.

Why did the New York Times miss its own ad forecast?

The Times reported Q3 digital ad revenue of $109.9 million, up 12% year over year. Most publishers would take that number gladly. But the company had projected growth in the "mid to high teens," and 12% was its slowest digital ad growth rate since Q4 2024, when it grew 9.5%.

Multiple investors pressed CEO Meredith Kopit Levien on the miss. She acknowledged in her opening remarks that the Times "isn't immune" to "Big Tech companies whose moves continue to result in less traffic to publishers." She did not directly answer whether AI search contributed to the shortfall. Instead, she kept reiterating that quarterly ad revenue is hard to predict.

That silence contrasts with People Inc. and Reddit, which have openly criticized Google for destroying their search traffic.

News Corp, which also reported on Wednesday, offers the counterpoint. Its Dow Jones division, which includes The Wall Street Journal, Barron's and MarketWatch, also grew digital ad revenue 12%. No investor complained. One offered his congratulations. The takeaway from the source: predicting your ad revenue may itself be a liability.

Do smart TV opt-outs actually stop tracking?

Not always, according to new Northeastern University research reported by The Verge. Researchers analyzed network traffic from 12 TV devices running eight operating systems, including LG, Amazon Fire, Google TV, Samsung, Roku, Vizio and VIDAA OS.

The findings:

• Most TVs tracked viewing on their built-in streaming services, but not on Netflix or YouTube.
• More than half tracked content arriving through HDMI, such as from a cable box or game console.
• Opting out stopped the data flow on most devices — but Samsung and Roku TVs kept sending data from their own streaming services, and Walmart-owned Vizio TVs continued transmitting as before.

The technology at issue is automatic content recognition (ACR), which fingerprints what a screen displays so advertisers can measure ad reach and frequency. It is now table stakes for the smart TV industry. Viewer scrutiny of it is growing.

What else moved this week?

• Uber fulfilled only four rides and 500 food orders from third-party AI agents last quarter, out of 320 million transactions, the company said.
• Crypto PACs spent $170 million on the midterms with little to show for it, Fortune reported.
• Elon Musk personally poured $440 million into election ads, per The Wall Street Journal.
• All thirteen municipalities with data center restrictions on the ballot appear to have passed them, Forbes reported. The most vocally anti-data center Senate candidates won their races, per Politico.
• Super PACs promoting AI-friendly politicians barely mentioned AI in their ads, Bellingcat found.
• Titan OS raised $46 million in seed funding, with much of it potentially aimed at expanding its smart TV ad business, TechCrunch reported.

For ad tech, the week's thread is exposure: exposure to malware through search ads, to opaque forecasts, and to viewers who cannot opt out of measurement they never knowingly chose.