How a Fake Job Interview Led to the Biggest Crypto Heist – and How to Spot the Trick
The theft of around 6.3 billion US dollars from Binance did not start with a flaw in the blockchain or a cracked password. According to the exchange's own findings, published on 3 November 2026, it started with a job interview that never really existed – and a coding test that one engineer downloaded onto his work computer.
How the attack unfolded
- September: A Binance engineer was contacted on a legitimate job platform by someone posing as a project director. Two "interviews" followed, with a supposed HR representative and the CEO of a company that did not exist.
- The coding test: At the end of the second interview, the engineer was asked to download a coding assignment onto his work computer. According to Binance, it contained malware that ran during setup, replaced part of a legitimate development tool, connected to a server controlled by the attackers and evaded the device's security software.
- 20 October: From the infected computer, the attackers took control of two colleagues' computers and found a credential that allowed them to deploy software in the wallet infrastructure.
- 29 October: They used this access to reach the wallet-signing service and move funds outside the normal withdrawal process.
Binance also disclosed an earlier incident from June, in which another engineer had installed tampered software. The device was replaced, but information about the wallet infrastructure team had already been exposed. Around 2.85 billion US dollars of the stolen assets have been frozen or intercepted so far. Independent security firms are to review Binance's findings. The FBI attributes the attack to TraderTraitor, a North Korean state-sponsored group.
A known pattern
Fake job offers with "test tasks" are a well-known method used by groups associated with North Korea to get into crypto companies. The approach works because it exploits normal behaviour: applicants want to make a good impression, and downloading a coding exercise seems harmless.
The trick is not limited to employees of exchanges. Developers, freelancers and private crypto users are also targeted – with job offers, collaboration requests or invitations to video calls that require installing supposedly necessary software.
How to protect yourself
- Verify the company independently: Check the website, the company's history and the recruiter's profile. If in doubt, contact the company through its official channels.
- Do not run unknown code on important devices: Coding tests, "project files" or tools from unknown contacts do not belong on a computer that has access to your work systems or your crypto. Developers should use a separate device or an isolated virtual machine.
- Be wary of download requests: A request to install a special meeting app, an "update" or a file to complete a task is a classic warning sign.
- Separate your devices: Use the computer you manage your bitcoin with as little as possible for experiments, downloads and unknown software.
- Keep your keys off the computer: With a hardware wallet, malware on your computer cannot read your private keys – but always check the address on the device's own screen.
Why it matters
The Binance case shows that the weakest link in security is often not the technology, but a single trusting moment. That applies to a large exchange as much as to private users. More on the hack itself in our article Binance hack: what the $6.3 billion theft means for your bitcoin, and more common scams in our guide 5 common crypto scams and how to spot them.
Sources
