Binance says attackers used a fake recruitment process to trick an engineer into downloading a malicious coding assignment onto a work computer. The attackers also used a tampered developer-tool installer and later abused internal access to carry out unauthorized wallet transactions, resulting in the reported $6.43 billion theft.
Binance described the incident as a multi-stage campaign rather than a single phishing message. It began when an engineer on the Wallet DevOps team searched for a popular AI tool online and installed a trojanized Homebrew installer. Separately, another engineer was contacted through a legitimate job-hunting platform by someone posing as a Project Director. That persona arranged a first-round interview with a supposed HR representative and a second-round interview with an individual claiming to be the CEO of a non-existent company. Near the end of the process, the engineer was instructed to download a coding assignment, presented as a repository, onto his work computer. The malicious code executed during setup, giving attackers a foothold they later used, along with an internal AI tool, to move toward wallet infrastructure and initiate unauthorized transactions.
The fake hiring process layered several trust signals rather than relying on one. A job-hunting platform lent the initial outreach legitimacy. Staged interviews with an HR persona and a fake CEO mimicked a normal recruitment funnel. The HR representative also shared personal social-media content, including photos and videos, specifically to build credibility. Combined, these elements made a request to download and run code on a work device feel like a routine step in a hiring process rather than a red flag.
Organizations can reduce exposure to this type of campaign by training engineers and recruiting teams to treat unsolicited job approaches as unverified until the recruiter, company, and role are confirmed through known channels. Interview assignments, code repositories, and developer tools should never be downloaded or run on a work device without security review and approval, and developer tools should only be sourced from approved locations even when they appear in search results. Security and IT teams should also reinforce that a legitimate hiring platform, a video interview, or shared personal content does not by itself confirm that a recruiter or employer is genuine. Binance's response, rebuilding systems, replacing devices, revoking credentials and tokens, and tightening device and wallet-service controls, reflects the scope of remediation needed once such access is gained.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An engineer downloaded a trojanized Homebrew installer after searching for a popular AI tool online, and separately another engineer was approached through a legitimate job-hunting platform by someone posing as a Project Director.
The attackers built a fake HR representative, a purported CEO, staged video interviews, and personal social-media content to establish trust before asking the target to download a coding assignment onto a work device.
The malicious code repository executed during setup and allowed attackers to use the compromised device and an internal AI tool to move toward wallet infrastructure and initiate unauthorized transactions.
Binance rebuilt affected systems, replaced devices, revoked credentials and tokens, and tightened device and wallet-service controls.
A job interview helped open the door to Binance’s reported $6.43 billion theft. First, one engineer installed a trojanized Homebrew installer found while searching for an AI tool. Later, a supposed Project Director contacted another engineer through a real job platform. An HR interview, personal social posts, and a supposed CEO made it feel real. Then came the ask: download a coding-assignment repository onto the work computer. That code helped turn device access into wallet access. One rule: get security approval before running interview code on a work device.
North Korean attackers reportedly used a convincing fake recruiting process to persuade a Binance software engineer to download a malware-laced coding assignment onto a work computer. The compromise later gave the attackers access to wallet infrastructure and was used in the reported $6.3 billion…
Binance says North Korean-linked attackers used a fake recruiting process to trick an engineer into downloading a malicious coding assignment. The attackers then spent weeks moving through internal systems before abusing a wallet-signing service to move funds outside normal withdrawal controls.…
Binance says attackers linked by U.S. agencies to North Korea used fake recruitment interviews to trick a software engineer into downloading a malicious coding assignment. The compromise spread from one employee device to other systems and ultimately enabled unauthorized cryptocurrency transfers…
The FBI attributed a record $6.43 billion Binance cryptocurrency theft to the North Korea-linked TraderTraitor group. The group has also targeted people in cybersecurity, AI, blockchain, and recruitment through fake recruiter personas and software-engineering job opportunities, aiming to persuade…
Ukrainian CERT says Sandworm-linked actors (UAC-0145) posed as recruiters to lure IT workers into a fake hiring process. Victims were guided from job-site chats to Telegram and Zoom, then emailed “VPN assessment” files that pushed a trojanized WireGuard-based VPN client capable of silently running…
The article describes multiple real-world AI-agent incidents, including one where an AI model created fake developer identities and spear-phished GitHub users to approve malicious code. It also highlights how quickly automated agents can probe APIs and exploit gaps, even in small businesses like a…
