Attackers linked to North Korea allegedly used a fake recruitment process to persuade a Binance software engineer to download a malicious coding assignment onto a work computer. They then used the compromised device, internal AI tooling, and stolen deployment credentials to reach wallet-signing systems and initiate unauthorized cryptocurrency transfers.
According to reporting on the incident, attackers linked to North Korea allegedly built a fake recruitment pipeline around a software engineering role. People posing as a Project Director, an HR representative, and the CEO of a fictitious company ran the candidate through two interviews before pushing a final technical assignment. That assignment contained a malicious code repository, and the candidate was instructed to download and run it on a work computer.
Once executed, the repository ran malicious code during setup, replaced a legitimate development-tool component, executed commands, and communicated with an attacker-controlled server. From that single compromised device, attackers reportedly used an internal AI tool to extend their reach into two additional employee environments. Eventually, they found a deployment-permission token sitting on a Wallet DevOps engineer's computer, and used it to help reach Binance's wallet-signing service, enabling unauthorized cryptocurrency transfers.
The scheme worked by exploiting normal hiring behavior rather than a software flaw. A multi-stage interview process, including a staged HR call and a CEO-impersonation step, built enough perceived legitimacy that moving the conversation to an informal chat app and requesting a downloaded assignment did not raise immediate alarm. The engineer was asked to complete real-feeling technical work on a corporate device, which is a normal part of many hiring pipelines and therefore not inherently suspicious on its face.
The article also describes a related pattern, tracked as WaterPlum or Contagious Interview, in which actors impersonate real AI, crypto, or NFT companies on social media, job boards, and freelance platforms, then ask candidates to download a file to complete a coding test or fix a bug during a video call.
Organizations can reduce exposure by running technical assignments only in isolated, non-production environments, keeping deployment credentials short-lived and tightly scoped, and ensuring internal AI tools never inherit unnecessary access to sensitive systems. Employees, especially those with cloud, deployment, or wallet-signing access, benefit from clear guidance to treat unsolicited recruitment outreach as a potential business-security risk and to verify recruiters through independent, known contact details before downloading or running anything on a work device.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers allegedly posed as a Project Director, HR representative, and CEO during a staged hiring process, then instructed a software engineer to download a technical assignment containing malicious code onto his work computer.
The malicious repository executed code during setup, replaced a legitimate development-tool component, and communicated with an attacker-controlled server, which attackers reportedly used along with an internal AI tool to compromise two more employee environments.
A deployment-permission token found on a Wallet DevOps engineer's computer was reportedly used to help attackers reach Binance's wallet-signing service.
The FBI attributed the reported operation to North Korea-linked TraderTraitor, also known as Lazarus Group and APT38.
A fake job interview helped open a path to Binance’s wallet systems. A supposed Project Director arranged HR and CEO interviews. Then, in a chat app: ‘Complete this technical assignment.’ The engineer downloaded its code repository onto a work computer. Here’s the trap: the repository ran code during setup. From that workstation, the intruders reportedly reached other employee environments, then a deployment token and wallet-signing service. The giveaway? An unverified interview asked for code on a corporate device. Don’t run interview assignments on your work computer.
North Korean-linked attackers reportedly used a fake job opportunity, multiple interviews, and a malicious coding assignment to compromise a Binance engineer. The scheme built trust over weeks before asking the employee to download an interview file, giving attackers a foothold in the company’s…
North Korean attackers reportedly used a convincing fake recruiting process to persuade a Binance software engineer to download a malware-laced coding assignment onto a work computer. The compromise later gave the attackers access to wallet infrastructure and was used in the reported $6.3 billion…
Binance says North Korean-linked attackers used a fake recruiting process to trick an engineer into downloading a malicious coding assignment. The attackers then spent weeks moving through internal systems before abusing a wallet-signing service to move funds outside normal withdrawal controls.…
Binance says attackers used a fake recruitment process to trick an engineer into downloading a malicious coding assignment onto a work computer. The attackers also used a tampered developer-tool installer and later abused internal access to carry out unauthorized wallet transactions, resulting in…
The FBI attributed a record $6.43 billion Binance cryptocurrency theft to the North Korea-linked TraderTraitor group. The group has also targeted people in cybersecurity, AI, blockchain, and recruitment through fake recruiter personas and software-engineering job opportunities, aiming to persuade…
Binance says attackers linked by U.S. agencies to North Korea used fake recruitment interviews to trick a software engineer into downloading a malicious coding assignment. The compromise spread from one employee device to other systems and ultimately enabled unauthorized cryptocurrency transfers…
