Fake Job Interview Helped Open the Door to $6.3 Billion Binance Hack

TLDR

Binance says a fake job interview was one entry point in its $6.3 billion October hack.
A Binance engineer downloaded a malicious coding test onto his work computer in September.
Security chief Jimmy Su described this exact risk to Cointelegraph in July.
Crypto recruiters say clients now ask if candidates were met in person.
Binance says it blocks a suspected North Korea-linked threat about every five days.

Crypto exchange Binance says a fake job interview helped attackers carry out the $6.3 billion hack it suffered in October. The method matches a threat its own security chief described months before the attack.
Chief security officer Jimmy Su spoke with Cointelegraph in July about rising security risks. He said fake job interviews were something the company worried about “a lot internally.”
Su explained that attackers could shape a job offer around a specific employee. They would then ask that person to run code as part of a technical test.
“And once that gets executed, the device is compromised and then they can start harvesting credentials,” Su said. He added that attackers could use that access to move deeper into the network.

NEW: Binance CSO Jimmy Su warned in July that fake job interviews could compromise employee devices, months before the same tactic helped attackers pull off the exchange’s $6.3B hack.https://t.co/CQUO8rWNBH
— Cointelegraph (@Cointelegraph) November 12, 2026

How the Attack Unfolded
In September, a Binance software engineer took part in what turned out to be a fake job interview. He downloaded a malicious coding assignment onto his work computer.
Binance’s preliminary investigation found this compromise became part of a multistage attack. That attack ended with October’s theft, the largest crypto exchange hack on record.
In July, Su had also explained why security software might miss such a trap. A coding test could include normal steps, such as downloading code from GitHub.
“Each step is actually legitimate on its own. So a lot of the anti-virus tools may not be able to detect it and flag it,” he said. These comments were not part of Cointelegraph’s July coverage.
Binance’s investigation later described a similar gap. It said the assignment’s setup process ran malware that slipped past the company’s endpoint security tools using obfuscation and other evasion methods.
Su said in July that employees were free to look at other jobs. “What we do worry about is that they do so on the company device,” he said.
If a worker fell for a fake interview, Su said, “the onus is on us to detect it.” He said the company’s job was to stop the code from running.
Binance had already been testing staff against fake recruiters. Su said its internal red team ran monthly phishing tests for three to four years, with extra training for employees who failed.
“In the beginning, the security hygiene left a lot to be desired,” Su said. He added that the company had improved a great deal since then.
Recruiters Change Hiring Checks
The fake interview threat is changing how some crypto firms hire. Kevin Gibson of recruitment firm Proof of Search said clients increasingly want to know if candidates were met face to face.
“A number of our clients are now asking us straight up whether we’ve met a candidate in person,” Gibson said. He said candidates met in person by a third-party recruiter now have an advantage.
Gibson said current employees can also be targets, as in Binance’s case. “In crypto, a dodgy job offer or a ‘quick catch-up call’ can be the first step in a multimillion-dollar hit,” he said.
Binance said it has blocked 57 suspected North Korea-linked cyber threats so far this year. That works out to about one attack every five days.
After the October attack, Binance said it tightened device controls and rebuilt affected wallet systems and internal AI tools. It also strengthened access controls and revoked compromised credentials.
The exchange said it is spending more on endpoint protection and developer environment security. It has also hired independent cybersecurity experts to review the incident, though some technical details will stay confidential.
The post Fake Job Interview Helped Open the Door to $6.3 Billion Binance Hack appeared first on Blockonomi.