Attackers linked to North Korea used a fake recruiting process to trick a Binance engineer into downloading a coding assignment onto a work computer. The malicious assignment gave the attackers a foothold, which they expanded through an internal AI tool and privileged engineering access to carry out unauthorized withdrawals.
This incident combined two separate initial access methods. In one case, a wallet-infrastructure engineer searched the web for a popular AI coding tool and downloaded a tampered installer instead of getting the software from a trusted source. In a second, more elaborate case, attackers posed as recruiters for a company that did not exist, ran two staged interviews including a fake HR contact and someone claiming to be the CEO, and then asked the engineer to download a coding assignment onto a work computer. That assignment contained malicious code. Once a device was compromised, attackers used an internal AI tool present on it to pivot to machines belonging to other engineers on the wallet infrastructure team, eventually locating a token that could deploy infrastructure containers.
The recruitment scam worked because it mimicked a legitimate hiring process closely enough to pass casual scrutiny. Two interviews, a social media profile filled with personal content, and a purported CEO conversation created a sense of legitimacy and urgency that made a coding assignment feel routine rather than suspicious. The separate software download succeeded because it bypassed an approved source, relying on a search result instead of a verified vendor channel. Both paths ultimately gave attackers a foothold on an engineer's work computer, which carried outsized risk because of the internal AI tool and the production access tied to that role.
The mix of a staged hiring process and a routine-looking software download shows how social engineering and basic technical hygiene gaps can combine to reach highly privileged engineering access.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers posed as a project director, HR representative, and CEO from a company that did not exist, ran two staged interviews to build trust, and then told the engineer to download a coding assignment containing malicious code onto a work computer.
A separate wallet-infrastructure engineer searched the web for a popular AI coding tool and downloaded a tampered Homebrew installer instead of getting the software from a trusted source.
Once malware was running on the engineer's computer, attackers used an internal AI tool present on it to pivot to additional machines belonging to two other engineers on the wallet infrastructure team.
The FBI attributed the attack to North Korea's TraderTraitor unit, which researchers associate with the Lazarus operation.
A coding test helped open the door to the Binance heist. A fake company contacted a Binance engineer. Two interviews followed: an HR contact with a social-media profile, then a supposed CEO. Next came a repository link. The assignment contained malicious code. On the work computer, it gave them access to an internal AI tool, other engineers' systems, and a container-deployment token. The interviews were the setup. The giveaway? An outside interview asked for code on a work machine. Keep outside coding tests off your work computer.
Binance says attackers used fake job-related downloads and a trojanized installer for a popular AI tool to compromise members of its wallet infrastructure team. The campaign ultimately gave the attackers access to an internal wallet-signing service and enabled a $6.43 billion theft outside the…
Attackers linked to North Korea reportedly used a fake recruiting process to trick a Binance software engineer into downloading and running a malicious code repository during a supposed job assessment. The compromise ultimately helped the attackers access Binance’s wallet systems and steal about…
Attackers reportedly used a fake recruiting process to target Binance software engineers over several months. They built trust through a legitimate job platform and a fake HR interview, then persuaded an engineer to download a malicious coding assignment onto a work computer. That access was later…
North Korean attackers reportedly used a convincing fake recruiting process to persuade a Binance software engineer to download a malware-laced coding assignment onto a work computer. The compromise later gave the attackers access to wallet infrastructure and was used in the reported $6.3 billion…
Binance says attackers used a fake recruitment process to trick an engineer into downloading a malicious coding assignment onto a work computer. The attackers also used a tampered developer-tool installer and later abused internal access to carry out unauthorized wallet transactions, resulting in…
Attackers linked to North Korea reportedly used fake recruitment interviews to trick Binance engineers into downloading malicious software. They then used a compromised engineer laptop and access to an internal AI tool to take over employee wallets and steal $6.3 billion in cryptocurrency.
