Fake Interviews Opened Door to Binance Heist

Attackers linked to North Korea reportedly used fake recruitment interviews to trick Binance engineers into downloading malicious software. They then used a compromised engineer laptop and access to an internal AI tool to take over employee wallets and steal $6.3 billion in cryptocurrency.

Key findings

• The FBI attributed the attack to North Korea, following reports that linked it to the state-sponsored TraderTraitor group.
• Attackers used fake recruitment interviews to reach Binance engineers and persuade one to download a malicious interview assignment.
• The malicious assignment reportedly replaced a legitimate development-tool component, allowing commands to run and communication with an attacker-controlled server.
• Attackers used the compromised laptop to access an internal Binance AI tool, take over other engineers' wallets, and later use stolen credentials in the theft.
• Binance said it detected 57 suspected North Korea-originated threats over several months, including fake interviews, social-engineering campaigns, and malicious software.

Who’s being targeted

• Commonly targeted roles: Software Engineers, Developers, Engineering Managers, AI Tool Users, IT and Security Teams, Employees actively seeking jobs.
• Affected industries: Cryptocurrency exchange and digital-asset services, Financial services, Technology and software development.
• Attack channels: email, website.
• Impersonated: Recruiter using a legitimate job-hunting platform, A purported Homebrew package-manager download source.

Awareness takeaways

• Treat recruiting messages as untrusted until the recruiter and employer are independently verified, even when the contact arrives through a legitimate job platform.
• Do not download or run interview assignments, code samples, package managers, or developer tools on a work device without following the organization's approved review process.
• Verify developer-tool downloads through official, approved sources; a tampered component can give attackers control of a work device.
• Report suspicious recruitment approaches and unexpected software requests promptly, because attackers may collect role and team information even if an initial compromise appears contained.

Red flags to watch for

• A job interview process requires downloading an unfamiliar file or software package.
• The assignment includes code or a development-tool component that must be executed locally.
• A recruiter contact on a legitimate platform is treated as automatically trustworthy.
• The package manager is obtained from an unverified source rather than an approved or official source.
• A development tool download is requested outside normal software-approval procedures.
• The installation is tied to a new AI tool and creates urgency to bypass verification.