Fake job interview behind US$6.3bn Binance heist puts hiring on notice

Ben Jones, practice lead, cyber security at Coder Trove, told HRD that the case should change how employers think about recruitment risk. “The hiring process has become an attack surface in its own right, for candidates coming in and for employees being approached from outside,” he said.

How a fake job interview got hackers inside Binance

According to Binance, the operation began in June 2026. An engineer on its wallet development team downloaded a software tool that hackers had tampered with, which exposed the roles of that engineer and their colleagues.

In September, a different software engineer who was looking for a new job was approached on a legitimate job-hunting platform. Jones said the sequence that followed was a model of the methods used by the Democratic People’s Republic of Korea (DPRK).

“Binance’s incident report reads like a textbook on DPRK recruitment tradecraft,” he said. “First-round interview with a fake HR rep on a live video call, complete with a social media profile full of personal photos and videos to make them feel real. Second round with a fake CEO over a chat app, where the engineer was told to download a coding assignment from a code repository. That assignment was the malware: custom, previously unseen, built to swap out a legitimate developer tool on the machine and quietly take commands from the attackers. Endpoint protection never saw it.”

The gradual approach was deliberate, Jones said. “Each stage was designed to lower the engineer’s guard a little further, so by the time the assignment landed, trust had been built over weeks and the download felt routine.”