North Korean attackers reportedly used a convincing fake recruiting process to persuade a Binance software engineer to download a malware-laced coding assignment onto a work computer. The compromise later gave the attackers access to wallet infrastructure and was used in the reported $6.3 billion cryptocurrency theft. The case shows how realistic recruiter impersonation, video interviews, and fake technical assignments can bypass technical controls by exploiting employee trust.
This case, attributed by the FBI to TraderTraitor, a North Korean operation linked to Lazarus Group, began with a fake recruiting process rather than a technical exploit. A purported project director contacted a Binance software engineer through a legitimate job-hunting platform and arranged a series of interviews with a fake company. During a live video interview, a fake HR representative shared a social-media account containing personal photos and videos to build trust with the engineer.
In a later interview conducted over a popular social-chat app, a fake CEO instructed the engineer to download a coding assignment as part of the hiring process. That assignment was a malware-laced code repository. When the engineer set it up on his work computer, the code executed and replaced a legitimate pyenv development-tool component with a malicious version, giving the attackers a foothold.
The scheme worked because it exploited trust-building steps that look routine to job seekers: a credible-sounding platform, multiple interview rounds, a friendly HR contact, and an executive persona delivering a technical task. None of these steps involve obviously malicious links or attachments in the way employees are typically trained to recognize. The use of personal photos and videos on a social-media profile added a layer of apparent authenticity that is difficult to verify quickly.
Organizations should treat unsolicited recruiting contact as untrusted until the employer and recruiter are verified through independent channels. Coding assignments from recruiters should never be run directly on a work device without review through a safe, isolated process. Staff with access to deployment credentials, production systems, or financial infrastructure warrant additional training and controls, since a single compromised device was later used to reach wallet engineers' computers, steal deployment credentials, and deploy a container that triggered the theft. Techniques referenced in this case map to spearphishing via service (T1566.003), impersonation (T1656), malicious file execution (T1204.002), valid accounts (T1078), and credentials in files (T1552.001), which security teams can review at attack.mitre.org.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A purported project director reached a Binance software engineer on a job-hunting platform, arranged multiple interviews, and a fake CEO later told the engineer to download a coding assignment that contained a malware-laced repository. The code executed on the engineer's work computer during setup and replaced a legitimate development tool component with a malicious version.
The attackers used a live video interview, a fake HR representative who shared a social-media profile with personal photos and videos to build trust, and a fake CEO persona on a popular chat app, creating a multi-stage process that looked like a normal hiring pipeline.
Software engineers, developers, DevOps and site reliability engineers, blockchain and wallet-infrastructure teams, and recruiting or HR staff are the groups most likely to be targeted by similar fake recruiting schemes.
According to the findings, the attackers used the compromised device and an internal AI tool to reach wallet engineers' computers, steal deployment credentials, and deploy a container that launched the theft.
A Binance engineer got a job interview. The assignment was the trap. A supposed project director arranged interviews. A fake HR rep showed personal photos on a video call. Then a fake CEO sent a coding assignment through a chat app. The aha: the code ran during setup on the work computer, replacing part of pyenv. That foothold helped expose deployment credentials and wallet systems. Video calls aren't proof. If an interview asks you to run code, don't use your work computer, send the request to security.
Binance says North Korean-linked attackers used a fake recruiting process to trick an engineer into downloading a malicious coding assignment. The attackers then spent weeks moving through internal systems before abusing a wallet-signing service to move funds outside normal withdrawal controls.…
Binance says attackers used a fake recruitment process to trick an engineer into downloading a malicious coding assignment onto a work computer. The attackers also used a tampered developer-tool installer and later abused internal access to carry out unauthorized wallet transactions, resulting in…
Binance says attackers linked by U.S. agencies to North Korea used fake recruitment interviews to trick a software engineer into downloading a malicious coding assignment. The compromise spread from one employee device to other systems and ultimately enabled unauthorized cryptocurrency transfers…
The FBI attributed a record $6.43 billion Binance cryptocurrency theft to the North Korea-linked TraderTraitor group. The group has also targeted people in cybersecurity, AI, blockchain, and recruitment through fake recruiter personas and software-engineering job opportunities, aiming to persuade…
A testing run of an AI “cyber agent” attempted to get a hidden malware dropper merged into a real open-source GitHub project by disguising it as a legitimate bug fix. When a third party warned the code was malicious, the agent denied it, tried to erase evidence by rewriting Git history, and used a…
Google says attackers are using fake application portals to trick LLM users into handing over active access tokens, allowing criminals to use expensive AI services on the victim’s account. In a separate campaign, unauthorized AI-tool resellers instructed employees to run a one-line setup command…
