Fake Job Interview Led to $6.3B Binance Heist, FBI Says

How the Binance $6.3B heist unfolded

It started with a supply chain attack and ended with a live video call.

Binance published an incident report on Tuesday describing a multi-stage campaign that began in June, when one engineer downloaded a malicious Homebrew installation. The security team caught the malware and replaced the device, but according to the report, the engineer's role on the wallet infrastructure team was already exposed.

The social engineering came in September. A second engineer was contacted on a legitimate job-hunting platform by someone posing as a project director. The first interview was a live video call with a fake HR representative who shared personal photos and videos to build trust—what Binance called 'more advanced and deceptive than previously seen social engineering approaches.'

A follow-up interview on a popular chat app ended with the fake CEO asking the engineer to download an 'assignment' containing a malware-laced code repository. The code ran during setup and quietly replaced a legitimate pyenv component with a malicious version.

From infected laptop to drained wallets

The malware went undetected by endpoint security and gave attackers a foothold.

Binance says its endpoint tools did not immediately flag the malicious script, which established communication with an attacker-controlled server. On October 20, the hackers used the compromised machine and an internal AI tool to reach the computers of a wallet DevOps engineer and another wallet developer.

The DevOps engineer's machine held a container deployment permission token. On October 29, the attacker used stolen credentials to deploy a container and trigger a script that launched the cryptocurrency-stealing attack.

The FBI attributed the theft to TraderTraitor, a North Korean operation linked to Lazarus Group. The same crew is known for both posing as IT workers to get hired by Western companies and posing as employers to lure engineers into downloading malware. This follows a pattern we've seen before: the FBI previously blamed North Korea for a record $6.7B Binance heist, and the playbook hasn't changed much.

What Binance is doing now

The exchange has rebuilt the compromised systems and is cooperating with law enforcement.

Binance says it has rebuilt the affected wallet system and internal AI tool, replaced all compromised devices, and decommissioned credentials and tokens assigned to the engineers involved. It is working with law enforcement, blockchain intelligence firms, and security researchers to trace and freeze assets.

The exchange has also hired independent cybersecurity experts to review the incident and says it plans to establish a security research fund focused on AI security in blockchain environments.

What it means for you

The attack is a reminder that job interviews can be attack vectors. If you work in tech—especially in crypto or finance—be wary of unsolicited interview requests from unfamiliar companies, and never run code from a 'take-home assignment' on a work machine without sandboxing it first. For a deeper look at how stolen credentials can rack up costs, see our coverage of LLMjacking.

Binance users outside the US should check the exchange's official statements for updates on withdrawals and asset recovery. The FBI's involvement means US-based assets may be subject to freezing orders.

The Binance heist is a case study in how a single infected laptop, combined with a convincing job interview, can lead to billions in losses. As crypto exchanges harden their perimeter, attackers are increasingly targeting the people inside.