Fake Job Interview Led to Binance Theft

Attackers reportedly used a fake job opportunity to trick a Binance software engineer into running a coding assignment on a work computer. The assignment installed malicious software, helping the attackers move through Binance systems and ultimately steal about $6.3 billion in cryptocurrency. The case shows that realistic recruiting approaches can be a route into highly sensitive production environments.

Key findings

• A Binance software engineer was contacted through a legitimate job-hunting site after the attacker identified Binance wallet-team personnel.
• The attacker built credibility through a live video interview with an apparent HR representative and a social-media profile containing personal photos and videos.
• A supposed CEO then used a popular chat application to deliver a short coding assignment to the engineer.
• The assignment ran malicious code during setup, replaced the legitimate pyenv tool with a doctored copy, and connected to an attacker-controlled server.
• The attackers later used the compromised device and an internal AI tool to gain access to two additional engineers' computers.
• A stolen token that could deploy containers and compromised credentials were used to access Binance's internal wallet-signing service.
• Binance says it detected and blocked 57 suspected state-sponsored attempts in 2026 involving fake job interviews, booby-trapped developer tools, poisoned browser extensions, and fake video-call applications.

Who’s being targeted

• Commonly targeted roles: Software Engineers, DevOps Engineers, Cloud and Infrastructure Engineers, Blockchain and Wallet Engineers, Developers with production access, Security Teams, Recruiting and HR Teams.
• Affected industries: Cryptocurrency exchanges, Financial services, Blockchain and digital-asset custody, Technology and software development.
• Attack channels: website, vishing.
• Impersonated: A project director, HR representative, and CEO of a fictitious company., A legitimate AI coding tool or its installation source..

Awareness takeaways

• Do not download or run job-interview assignments on a work device, especially if the assignment requires installing tools or executing setup scripts.
• Treat a polished recruiter profile, video interview, and social-media presence as identity claims to verify, not proof that a recruiter or company is legitimate.
• Security teams should explicitly include employee job hunting in threat models and provide a safe, isolated process for evaluating recruiting tests.
• Employees with production, wallet, infrastructure, or deployment access need heightened safeguards because a single compromised endpoint can enable broader access.

Red flags to watch for

• The company represented by the supposed CEO did not exist.
• The assessment required downloading and running software rather than submitting code through a trusted platform.
• The recruiting contact escalated from a job-hunting site to a chat application before delivering executable content.
• The installation source was tampered with.
• A common developer tool was used as a trusted-looking delivery mechanism.
• Unexpected anomalies after installation can indicate a compromised development environment.