Constella Intelligence found that a potential Binance employee's Mac reached a fake Homebrew page through a Google ad and began running a MacSync-style stealer 16 seconds later, exposing the login password, Keychain data, OAuth tokens, and 57 Binance-linked credentials. The report places this infection in March 2026, three months before the tampered-Homebrew compromise in Binance's disclosed intrusion chain. Binance's initial findings cited FBI information attributing the October 29 theft to North Korea, but the analyzed log contains no wallet systems, deployment token, or other evidence linking it to that theft. The report therefore treats the March exposure as a serious but unproven precursor or separate incident.