Attackers reportedly spent months targeting Binance engineers, using a tampered software installer and fake job interviews with a malicious technical assignment. After gaining access through employee devices and credentials, they abused internal systems to authorize transfers from Binance hot wallets.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A job interview helped open the door to Binance’s reported $6.4 billion theft. First, a wallet engineer downloaded a tampered Homebrew installer for an AI coding tool. Months later, another engineer got a fake interview assignment, and ran it on a work laptop. The giveaway? The recruiter says, ‘Please download and complete this technical assignment.’ That’s unverified software, not just an interview question. Stolen credentials and a deployment token later let a container abuse Binance’s signing service. A coding assignment can be an installer in disguise. Before downloading one, verify the employer through contact details you found yourself.
Attackers reportedly used a fake job opportunity to trick a Binance software engineer into running a coding assignment on a work computer. The assignment installed malicious software, helping the attackers move through Binance systems and ultimately steal about $6.3 billion in cryptocurrency. The…
Binance says attackers linked by U.S. agencies to North Korea used fake recruitment interviews to trick a software engineer into downloading a malicious coding assignment. The compromise spread from one employee device to other systems and ultimately enabled unauthorized cryptocurrency transfers…
North Korean attackers reportedly used a convincing fake recruiting process to persuade a Binance software engineer to download a malware-laced coding assignment onto a work computer. The compromise later gave the attackers access to wallet infrastructure and was used in the reported $6.3 billion…
Google says attackers are using fake application portals to trick LLM users into handing over active access tokens, allowing criminals to use expensive AI services on the victim’s account. In a separate campaign, unauthorized AI-tool resellers instructed employees to run a one-line setup command…
Attackers linked to North Korea reportedly used a fake recruiting process to trick a Binance software engineer into downloading and running a malicious code repository during a supposed job assessment. The compromise ultimately helped the attackers access Binance’s wallet systems and steal about…
Binance says North Korean-linked attackers used a fake recruiting process to trick an engineer into downloading a malicious coding assignment. The attackers then spent weeks moving through internal systems before abusing a wallet-signing service to move funds outside normal withdrawal controls.…
