Fake Interview Opens Door to Binance Heist

Attackers linked to North Korea reportedly used a fake recruiting process to trick a Binance software engineer into downloading and running a malicious code repository during a supposed job assessment. The compromise ultimately helped the attackers access Binance’s wallet systems and steal about $6.34 billion in digital assets. The incident shows why job-related files, coding tests, and interview requests can be high-risk, even when they arrive through a legitimate job platform.

Key findings

• An engineer first installed a tampered version of Homebrew after seeking an AI coding tool, giving attackers information about wallet-infrastructure personnel.
• Attackers later contacted a Binance software engineer through a legitimate job-hunting platform while posing as a Project Director.
• The fake recruitment process included a first-round HR interview, a second-round interview with a person claiming to be the CEO of a fictitious company, and a live video screening.
• As part of a supposed assessment, the employee was asked to download a code repository onto a company-issued computer.
• The repository contained malware that replaced a legitimate pyenv executable with a malicious copy and launched a zsh process.
• The FBI attributed the attack to North Korea and tied it to TraderTraitor, a group associated with the earlier Bybit theft.
• The report reinforces that job offers and technical assessments can be used to persuade employees to download and execute malicious files on corporate devices.

Who’s being targeted

• Commonly targeted roles: Software Engineers, Developers, DevOps Engineers, Cloud and Infrastructure Teams, Cryptocurrency and Financial Services Employees, Hiring Managers, Human Resources, All employees who use corporate devices for job searches or technical assessments.
• Affected industries: Cryptocurrency exchanges, Financial services, Blockchain and digital-asset services, Software engineering, Defense industry.
• Attack channels: website, vishing.
• Impersonated: A Project Director, HR representative, and CEO of a fictitious company, A legitimate AI coding-tool or software-download source.

Awareness takeaways

• Treat unsolicited job approaches as potentially risky, even when they arrive through a legitimate recruiting or job-hunting platform. Independently verify the recruiter and company using known contact details before progressing to interviews or assessments.
• Do not download, open, or run interview assessments, code repositories, installers, or test projects on a corporate device unless they have been reviewed through approved security processes.
• Be especially cautious when a recruitment process pressures technical staff to execute code or install tools as proof of skill; use an isolated, approved testing environment if an assessment is legitimate.
• Report suspicious software-download prompts and recruiting contacts promptly, because an apparently limited compromise can help attackers map colleagues, roles, and privileged systems.

Red flags to watch for

• An unfamiliar recruiter uses a legitimate job platform to establish trust.
• The applicant is asked to download and execute code on a company-issued device.
• The purported CEO represents a fictitious company.
• A software installer is obtained outside the organization’s approved software-distribution process.
• A trusted tool or package manager is presented in a tampered form.
• The request requires installing software on a corporate device.