Binance says attackers used a convincing fake recruiting process to trick an engineer into downloading a malicious interview assignment. After gaining access to the engineer's computer, the attackers reportedly used an internal AI tool to compromise two additional engineers' laptops, contributing to a record $6.3 billion crypto theft.
This incident began with a seemingly ordinary job search. An engineer was contacted through a legitimate job site by people posing as company recruiters. The process looked normal at first: a conversation, an interview, and social media accounts with personal photos used to build trust in the recruiters' identities. During a second interview, the engineer was asked to download a technical assignment as part of the hiring process. That file contained malware.
Once the engineer's computer was compromised, the attackers reportedly used an internal AI tool along with the access they already had to take over two additional engineers' laptops. Binance has linked this chain of events to a record 6.3 billion dollar crypto theft, underscoring how a single social engineering foothold can cascade into a much larger compromise.
The scenario worked because it mirrored a completely normal hiring experience. Job platforms, multi-stage interviews, and take-home coding assignments are standard practice in software engineering recruitment, so there was little reason for the target to be suspicious. The attackers reinforced this by supplying supporting social media profiles with personal photos, giving the appearance of real people behind the recruiter accounts.
The critical weak point was the request to download and run an unknown file on a work device. Because this step fit within an expected hiring workflow, it bypassed the kind of scrutiny that an unsolicited email attachment might receive.
For engineers and candidates, the core lesson is to never install software or run a test file just because a recruiter asked, and to use a separate device if a coding task must be executed locally. Verifying a company through its own official website and phone number, rather than the contact details or links a recruiter supplies, helps confirm that a job site profile actually represents who it claims to be.
For hiring teams, take-home exercises should be designed to run in a browser or an approved online sandbox rather than requiring a downloaded file. Organizations should also state clearly in writing what candidates will and will not be asked to install, removing ambiguity that attackers can exploit. These changes reduce the attack surface this technique relies on without disrupting a legitimate hiring process.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An engineer was contacted through a legitimate job site by attackers posing as recruiters, and during a second interview he was asked to download an assignment that contained malware.
Binance says the attackers used the compromised computer and an internal AI tool to take over two additional engineers' laptops.
The fake recruiters used social media accounts with personal photos to build trust with the targeted engineer.
Design take-home exercises that run in a browser or approved sandbox and state clearly in writing what candidates will and will not be asked to install.
A job interview helped set up a $6.3 billion crypto theft. A recruiter contacted a Binance engineer through a real job site. Personal-photo profiles looked convincing. In interview two: ‘Download this technical assignment.’ The file was malware. Here’s the catch: the job site was real; the assignment wasn’t. Binance says the compromised computer and an internal AI tool helped reach two more engineers’ laptops. One rule: never run a recruiter’s assignment file on your work device.
Attackers linked to North Korea used a fake recruiting process to trick a Binance engineer into downloading a coding assignment onto a work computer. The malicious assignment gave the attackers a foothold, which they expanded through an internal AI tool and privileged engineering access to carry…
Binance says attackers used fake job-related downloads and a trojanized installer for a popular AI tool to compromise members of its wallet infrastructure team. The campaign ultimately gave the attackers access to an internal wallet-signing service and enabled a $6.43 billion theft outside the…
Attackers linked to North Korea reportedly used a fake recruiting process to trick a Binance software engineer into downloading and running a malicious code repository during a supposed job assessment. The compromise ultimately helped the attackers access Binance’s wallet systems and steal about…
Attackers reportedly used a fake recruiting process to target Binance software engineers over several months. They built trust through a legitimate job platform and a fake HR interview, then persuaded an engineer to download a malicious coding assignment onto a work computer. That access was later…
North Korean attackers reportedly used a convincing fake recruiting process to persuade a Binance software engineer to download a malware-laced coding assignment onto a work computer. The compromise later gave the attackers access to wallet infrastructure and was used in the reported $6.3 billion…
Binance says attackers used a fake recruitment process to trick an engineer into downloading a malicious coding assignment onto a work computer. The attackers also used a tampered developer-tool installer and later abused internal access to carry out unauthorized wallet transactions, resulting in…
