How a fake job interview led to the $6.34 billion Binance heist, and how to spot fake recruiter scams
Binance's incident report says North Korean hackers used a fake recruiter, a malicious coding test and a tampered download to steal about $6.34 billion. Here's what happened and how to protect yourself.
New details have emerged about the biggest crypto theft on record. Binance’s incident report says the $6.34 billion hack did not start with a technical flaw. It started with a fake job interview. The attackers, identified by the FBI as North Korean, tricked an engineer into running malicious code. Here is how it happened and how to avoid the same trap. We covered the first news in our earlier Binance report.
What did Binance say happened?
Binance said it was “not a single isolated breach or a simple phishing incident.” It described a chain of steps that combined social engineering through fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise and an advanced transaction-approval method.
- June: an engineer on the wallet DevOps team looked for a popular AI coding tool and installed a tampered version of Homebrew, the Mac package manager. Binance’s security team caught it and replaced his device, but the attackers had already learned his role and his colleagues’ names.
- September: a second engineer was contacted on a legitimate job site by someone posing as a “Project Director,” followed by two interviews, the second with a person claiming to be the CEO of a made-up company.
- The trap: after a video screening, the engineer was asked to download a code repository onto a company-issued laptop as a test. It hid malware that was not detected by the security tools at the time.
- October 20: the attackers used that laptop and an internal Binance AI tool to take control of two more engineers.
- October 29: using stolen credentials, they deployed a container and ran a script that reached Binance’s wallet-signing service, then abused an Ethereum feature called EIP-7702 to give a contract they controlled partial rights over a Binance hot wallet.
What happened to the money?
About $6.34 billion left Binance wallets on October 29. Tether, Circle and other partners helped freeze close to $3 billion within the first day, and Binance promised to cover all user losses. The FBI later confirmed that North Korea was responsible, linking it to the group known as TraderTraitor, which was also behind the $1.5 billion Bybit hack in February 2025. Binance began restoring withdrawals in phases on November 1, and co-CEO Richard Teng said the exchange is now 98% replenished.
Binance also says its investigation is ongoing and will be reviewed independently. Some security experts criticized the company’s description of the malware as a “zero-day,” arguing that the real issue was employees running malicious files.
What does this mean for Binance users?
- Binance says it will cover user losses, and withdrawals are being restored in phases.
- Expect scam messages pretending to be Binance support. Use only the official app and website.
- Turn on strong two-factor login and withdrawal allow-lists, and never share your recovery phrase.
Our data breach checklist has a full set of steps.
How to spot a fake recruiter
This is a long-running North Korean tactic, often called “Operation Dream Job”, where attackers pose as recruiters offering jobs at well-known companies. Watch for these red flags:
- A coding test that asks you to download and run code. Real assessments rarely need you to run unknown projects on your own machine.
- A work laptop used for job hunting. Never do interviews or tests on your employer’s device.
- A company you can’t verify. Check the company website, staff on LinkedIn and a phone number you find yourself.
- A job that is too good or too eager. High pay, fast offers and pressure to act quickly are warning signs.
- Odd software requests, such as installing a special PDF reader, video tool or “assessment app”.
- A profile that mentions your employer. Attackers study your public profile to sound convincing.
How to stay safer
- If you must test code, use a throwaway virtual machine or a separate device with no access to work or personal accounts.
- Don’t install software from links in chats or emails, and download tools only from official sources.
- Companies should limit what can be downloaded and run on work laptops and limit the permissions each person has.
- Keep keys and tokens out of everyday laptops. See our guide to the Cursor extension backdoor for another example of a trusted tool being abused.
Frequently asked questions
How did the Binance hack start?
According to Binance, it began with a tampered Homebrew download in June and a fake job interview in September that got an engineer to run malicious code on a company laptop.
How much was stolen?
About $6.34 billion left Binance wallets on October 29, and close to $3 billion was frozen. Binance says it will cover all user losses.
Who was behind it?
The FBI says North Korea was responsible, tying the attack to the TraderTraitor group.
How can I tell if a recruiter is fake?
Be suspicious of any recruiter who asks you to download and run code, install special software or use your work laptop, and verify the company independently.
