Attackers attributed to North Korea stole $6.3 billion in cryptocurrency from Binance after compromising engineers’ computers and gaining access to wallet-draining tools. One engineer was approached through a legitimate job platform and drawn into fake interviews supported by convincing fake company representatives and social-media profiles.
According to reporting referenced in the source material, attackers attributed to a North Korean threat group known as TraderTraitor approached a Binance engineer through a legitimate job-hunting platform. The engineer was invited into fake interviews with fake company representatives, who used social media accounts containing personal photos to build trust and appear credible. This recruiting pretext ultimately contributed to the compromise of engineers' computers, giving attackers control of tools used to drain wallets. The incident, described as the largest crypto theft to date, also involved a compromised internal AI tool.
The scheme worked because it exploited a trusted channel, a legitimate job-hunting platform, rather than a suspicious cold email. The fake recruiters layered in social proof by sharing personal photos and social media profiles, which can feel more convincing than a generic corporate message. Software engineers, developers, and other technical staff are frequent targets for this kind of approach because interview processes commonly involve running code samples or installing assessment software, giving attackers a natural reason to ask a target to execute something on their machine.
Organizations and individuals can reduce exposure to this type of recruiting-based social engineering by treating unsolicited recruiting contact as unverified until confirmed through known corporate channels. Engineers and other high-privilege staff, especially those with access to production or payment systems, should be encouraged to report suspicious recruiting contact to security teams before continuing the conversation. As a practical safeguard, any coding test, interview software, or file sent by an unfamiliar recruiter should never be run on a primary work device; using a throwaway machine, or declining altogether, removes the most common path attackers use to get malware onto a developer's system. Because this tactic specifically targets the hiring process, security awareness training for technical teams should explicitly cover recruiting-themed social engineering alongside more traditional phishing scenarios.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An engineer was contacted through a legitimate job-hunting platform and invited into fake interviews with fake company representatives, who built trust using social media accounts with personal photos.
The FBI attributed the attack to TraderTraitor, a North Korean threat group, according to the source material.
The impersonators used social-media profiles containing personal photos as apparent proof of legitimacy rather than verifiable corporate contacts, and pressed the target to move quickly into interviews.
Independently verify the recruiter and company through known corporate channels before engaging, and avoid running any coding tests or interview software supplied by the unknown recruiter on a work device.
A job interview helped open the door to Binance’s $6.3 billion crypto theft. It started on a real job platform: an attractive offer, fake company representatives, then social profiles with personal photos to make the interviews feel legitimate. That’s the trick: a real platform and friendly photos aren’t proof. Engineers’ computers were compromised; wallet-draining tools were reached. Even an internal AI tool was compromised. If an unsolicited recruiter rushes you toward an interview or assessment, send the message to Security before engaging.
Attackers reportedly spent months targeting Binance engineers, using a tampered software installer and fake job interviews with a malicious technical assignment. After gaining access through employee devices and credentials, they abused internal systems to authorize transfers from Binance hot…
Attackers reportedly used a fake recruiting process to target Binance software engineers over several months. They built trust through a legitimate job platform and a fake HR interview, then persuaded an engineer to download a malicious coding assignment onto a work computer. That access was later…
Attackers linked to North Korea reportedly used a fake recruiting process to trick a Binance software engineer into downloading and running a malicious code repository during a supposed job assessment. The compromise ultimately helped the attackers access Binance’s wallet systems and steal about…
North Korean attackers reportedly used a convincing fake recruiting process to persuade a Binance software engineer to download a malware-laced coding assignment onto a work computer. The compromise later gave the attackers access to wallet infrastructure and was used in the reported $6.3 billion…
Binance says attackers used a fake recruitment process to trick an engineer into downloading a malicious coding assignment onto a work computer. The attackers also used a tampered developer-tool installer and later abused internal access to carry out unauthorized wallet transactions, resulting in…
Elastic researchers documented real intrusions in which attackers used deceptive verification pages, fake invitations, and phishing sign-in workflows to gain access. In confirmed infostealer cases, attackers used stolen credentials an average of eight minutes after infection, and one healthcare…
