Binance says attackers linked by U.S. agencies to North Korea used fake recruitment interviews to trick a software engineer into downloading a malicious coding assignment. The compromise spread from one employee device to other systems and ultimately enabled unauthorized cryptocurrency transfers totaling $6.34 billion.
The campaign described in this incident relied on fake recruitment interviews to reach software engineers directly, bypassing many traditional technical defenses. A threat actor posing as a recruiter engaged a target through a multi-step interview process. During the second interview, the engineer was instructed to download a technical assignment. That assignment contained a malicious code repository. Running it gave the attackers an initial foothold inside the organization's systems.
From that single compromised device, the attackers expanded their access. They moved laterally to two additional devices and used stolen employee credentials to reach critical wallet tools. This progression, from one engineer's workstation to systems controlling cryptocurrency transfers, ultimately enabled unauthorized transactions totaling $6.34 billion.
This attack succeeded because it targeted a process that developers go through regularly and rarely question: a job interview with a technical assignment. Asking a candidate to download and run code is a normal part of many hiring pipelines, which made the malicious request blend in with expected behavior. The attackers also combined multiple techniques, including fake recruitment interviews, malicious software downloads, compromised internal tooling, endpoint compromise, and credential theft, layering several social engineering and technical methods together.
A related pattern involved persuading developers to install what appeared to be a popular AI coding tool, which instead delivered malware. Because developers often seek out and install productivity tools independently, this vector exploited routine behavior rather than an obvious red flag.
Organizations supporting engineering teams should treat interview-stage code assignments and informal developer tool downloads as potential attack surfaces, not just hiring or productivity activities. Establishing approved channels for both recruitment-related downloads and developer tooling, and encouraging engineers to verify recruiters and software sources before running anything on a work device, reduces the chance that a single download leads to broader compromise. Given that this campaign involved dozens of related attempts using fake job offers, malicious browser extensions, and compromised video-conferencing tools, awareness training should reflect the full range of pretexts attackers use to reach technical staff, not just one scenario.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A software engineer was contacted with a fake job offer and, during a second interview, was told to download a technical assignment that contained a malicious code repository. Running that download gave the attackers access to Binance systems.
The attackers moved from the initially compromised engineer device to two additional devices and used stolen employee credentials to access critical wallet tools.
U.S. agencies attributed the theft to TraderTraitor, a North Korea-linked threat group, though North Korea denied responsibility.
Binance said it had stopped 57 other attempts during 2026 involving fake job offers, developer-tool malware, compromised browser extensions, and malicious video-conferencing tools.
A second interview sounds promising. At Binance, it was the trap. The fake recruiter said, 'Download and complete this technical assignment.' The code repository was malicious. Running it compromised the engineer’s device, then two more. Here’s the twist: the assignment wasn’t testing code. It opened access to Binance systems. Stolen credentials reached wallet tools; unauthorized transfers totaled $6.34 billion. If an interview asks you to run code on your work device, stop. Verify the recruiter through the company’s official website.
Binance says North Korean-linked attackers used a fake recruiting process to trick an engineer into downloading a malicious coding assignment. The attackers then spent weeks moving through internal systems before abusing a wallet-signing service to move funds outside normal withdrawal controls.…
North Korean attackers reportedly used a convincing fake recruiting process to persuade a Binance software engineer to download a malware-laced coding assignment onto a work computer. The compromise later gave the attackers access to wallet infrastructure and was used in the reported $6.3 billion…
Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
Binance says attackers used a fake recruitment process to trick an engineer into downloading a malicious coding assignment onto a work computer. The attackers also used a tampered developer-tool installer and later abused internal access to carry out unauthorized wallet transactions, resulting in…
The FBI attributed a record $6.43 billion Binance cryptocurrency theft to the North Korea-linked TraderTraitor group. The group has also targeted people in cybersecurity, AI, blockchain, and recruitment through fake recruiter personas and software-engineering job opportunities, aiming to persuade…
