Binance says North Korean-linked attackers used a fake recruiting process to trick an engineer into downloading a malicious coding assignment. The attackers then spent weeks moving through internal systems before abusing a wallet-signing service to move funds outside normal withdrawal controls. This is a strong example of how a convincing job offer can be used as the first step in a long-term business compromise.
The operation began with what looked like an ordinary job search. Binance says an engineer was contacted through a legitimate job-hunting platform by a fake recruiter who used convincing social-media accounts and personal photos to appear credible. The process unfolded across multiple stages, including a video interview and a second-round online interview, before the engineer was told to download a coding assignment containing a malicious repository onto a work computer. A second engineer separately downloaded a tampered Homebrew installation found through an online search, an incident that was detected but still left information about that employee exposed.
The attack worked because it exploited trust built over time rather than a single rushed message. The job platform was legitimate, the recruiter's online presence looked authentic, and the technical assignment fit naturally into a normal interview process. None of these steps looked unusual on their own. Once the malicious repository was downloaded, Binance says attackers used the foothold to move through internal systems, obtain login access, and eventually exploit an internal wallet-signing service, turning a single endpoint compromise into a much larger business impact.
Organizations should treat recruiting interactions as a potential entry point for compromise, not just an HR process. Engineers and developers should be encouraged to complete interview assignments in isolated or approved environments rather than on primary work devices, and to verify recruiters through independent channels before proceeding with technical tasks. Security teams should also recognize that an initial malware download, however small it looks, can be the first step toward lateral movement and access to sensitive systems such as wallet-signing services. As the awareness takeaways note, the initial compromise is just a foothold, and defenders should plan their monitoring and response accordingly, watching for unusual internal movement following any endpoint infection tied to a recruiting or job-search interaction.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Binance says an engineer was contacted through a legitimate job-hunting platform and drawn into a multi-stage recruiting process run by a fake recruiter using convincing social-media profiles and photos.
Near the end of a second-round interview, the engineer was instructed to download a coding assignment containing a malicious repository onto a work computer.
Binance says attackers used the initial foothold to move through internal systems, obtain login access, and exploit an internal wallet-signing service, showing how one compromised device can escalate into a business-wide compromise.
The FBI attributed the attack to TraderTraitor, a North Korean-linked group known for targeting cryptocurrency organizations.
A job interview helped open the door to a Binance crypto heist. A fake recruiter approached an engineer on a real job platform, showed convincing social profiles, then said: ‘Second-round interview. Download this coding assignment.’ The repository was malicious. On a work computer, that download became a foothold. Weeks later, the intruders abused Binance’s wallet-signing service to move funds. The giveaway: interview code on a work device. Send any interview assignment through your company’s approved review process before downloading it.
Binance says attackers linked by U.S. agencies to North Korea used fake recruitment interviews to trick a software engineer into downloading a malicious coding assignment. The compromise spread from one employee device to other systems and ultimately enabled unauthorized cryptocurrency transfers…
North Korean attackers reportedly used a convincing fake recruiting process to persuade a Binance software engineer to download a malware-laced coding assignment onto a work computer. The compromise later gave the attackers access to wallet infrastructure and was used in the reported $6.3 billion…
Binance says attackers used a fake recruitment process to trick an engineer into downloading a malicious coding assignment onto a work computer. The attackers also used a tampered developer-tool installer and later abused internal access to carry out unauthorized wallet transactions, resulting in…
The FBI attributed the theft of roughly $6.3 billion from Binance to North Korea's TraderTraitor operation, which is linked to the Lazarus Group. The reported Binance breach began with a compromised DevOps engineer laptop, while the group has previously used fake job offers and recruitment…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
The FBI attributed a record $6.43 billion Binance cryptocurrency theft to the North Korea-linked TraderTraitor group. The group has also targeted people in cybersecurity, AI, blockchain, and recruitment through fake recruiter personas and software-engineering job opportunities, aiming to persuade…
