Fake Job Interview Leads to Binance Heist

Attackers reportedly used a fake recruiting process to target Binance software engineers over several months. They built trust through a legitimate job platform and a fake HR interview, then persuaded an engineer to download a malicious coding assignment onto a work computer. That access was later used to reach systems involved in wallet-signing operations.

Key findings

• The attackers identified Binance employees through public job-platform profiles and posed as a project director to contact them.
• A fictitious HR representative used a social-media account containing personal photos and videos to build credibility during an interview.
• The target was instructed to download a supposed interview assignment, which was a malicious code repository that executed during setup.
• The initial device compromise was later used to access an internal AI tool and compromise additional employees involved in wallet operations.
• The campaign culminated in unauthorized transfers from Binance hot wallets to attacker-controlled addresses.

Who’s being targeted

• Commonly targeted roles: Software Engineers, Developers, DevOps Engineers, Wallet Operations Teams, IT and Security Teams, Recruiting and HR Teams.
• Affected industries: Cryptocurrency exchanges, Financial services, Software development.
• Attack channels: website.
• Impersonated: Project director and HR representative for a fictitious employer, Recruiter or interviewer for a fictitious employer.

Awareness takeaways

• Treat unsolicited recruiting outreach as a potential security risk, especially when the sender knows where you work and pushes the conversation to another platform.
• Do not download or run interview assignments on a corporate computer unless the employer and repository have been independently verified and the activity is approved.
• Do not rely on personal-looking social-media profiles as proof that a recruiter or interviewer is legitimate.
• Limit what can be downloaded and executed on developer workstations, and keep permissions tightly scoped.

Red flags to watch for

• An unsolicited recruiter specifically references the employee's current employer.
• The recruiter quickly moves the conversation away from the original job platform.
• Trust is built through a personal-looking social-media profile rather than independently verifiable company information.
• A job interview requires downloading code onto a corporate device.
• The assignment comes from an unverified repository or unfamiliar source.
• The request asks the candidate to run setup steps rather than only review code in a safe environment.