Fake Job Interview Opened the Door to Binance’s $6.3 Billion Hack

Binance, the cryptocurrency exchange, has published a postmortem on the October 29 theft of about $6.34 billion in digital assets, and the starting point was not an exotic exploit. According to the company, attackers posed as recruiters, ran an engineer through two rounds of interviews and then handed him a “coding assignment” that quietly installed malware. The FBI has attributed the attack to a North Korean state-backed group known as TraderTraitor, also tracked as Lazarus Group, Jade Sleet and APT38.

How the attack unfolded

Binance describes a campaign that ran for months rather than a single strike:

• June: an engineer working on the company’s wallet systems downloaded a tampered Homebrew installer for a popular AI coding tool, which he found through a search engine. The Verge reports it was apparently spread through a malicious Google ad. Binance says it spotted this and replaced his device, but the incident had already leaked details about his colleagues and how they worked.
• September: a second engineer was approached on a legitimate job-hunting platform by someone claiming to be a “Project Director” at a company that did not exist. A supposed HR representative held a live video call and shared a personal social media account full of photos and videos to seem genuine. A second interview, with a fake CEO, happened over a chat app, where the engineer was told to download an assignment from an online code repository.
• October 20: using that engineer’s infected computer and an internal Binance AI tool, the attackers took over the machines of the first engineer and a third colleague, collecting credentials and a deployment token.
• October 29: they logged into the third engineer’s computer, ran a malicious script and gained access to the exchange’s wallet signing service, moving funds across several blockchains.

What the malware did

The assignment contained previously unseen malware that Binance says its endpoint security tools did not catch. On the engineer’s Mac it swapped out pyenv, a common developer tool for managing Python versions, for a lookalike that took orders from a server controlled by the attackers. The company said the software used “sophisticated obfuscation and evasion techniques” and erased traces of its own activity as it went.

Binance also explained why it could not halt the transfers quickly. Its hot wallet, the online wallet used for day-to-day withdrawals, relied on Multi-Party Computation, which spreads signing power across several parties so there is no single key to cancel. The attackers abused an Ethereum feature called EIP-7702 to keep moving funds after withdrawals were suspended, because those transactions had already been authorized.

Why it matters for everyday users

Most readers do not run crypto wallet infrastructure, but the entry point here is a scam anyone job hunting in tech could meet. BleepingComputer notes that fake recruiters handing out booby-trapped coding tests are a known North Korean tactic, seen in campaigns called Contagious Interview and Operation Dream Job. In June 2025, the security firm Socket reported one such campaign that impersonated recruiters on LinkedIn and spread 35 malicious npm packages built to steal browser logins and crypto wallet data.

A few habits reduce the risk:

• Be wary of any interview that asks you to download and run code, especially on a work computer or one that holds work accounts.
• If you must complete a take-home task, use a separate machine or a disposable virtual machine.
• Download software from the developer’s official site rather than clicking search ads.
• Remember that a friendly video call and a polished social profile prove little.

Losses and what is still unclear

Binance says customers will not bear the loss. About $2.85 billion has been frozen or intercepted, and 98 percent of affected tokens had been replenished as of October 31, with the company buying the remaining, harder-to-trade assets. CEO Richard Teng said withdrawals “have broadly resumed.” By November 3, Binance says it had rebuilt the affected wallet system and AI tools, replaced devices, revoked stolen credentials and added AI-based anomaly detection.

Open questions remain. Binance has shared little about the internal AI tool the attackers used or why it gave them so much reach, and it has not tied the fake interview to a specific known campaign. The exchange says its investigation continues, with independent security firms reviewing its findings.

Sources: Engadget, The Verge, BleepingComputer