Binance says fake job interview let attackers reach wallet-signing systems
In brief
- Binance said it thwarted 57 suspected North Korea-linked cyber threats in 2026.
- A staged job interview's coding assignment carried malware onto an engineer's work computer.
- Stolen credentials later let attackers reach Binance's wallet-signing infrastructure, the exchange said.
- The FBI on Oct. 31 attributed the related theft to North Korea's TraderTraitor operation.
How the intrusion unfolded
The earliest identified stage came in June, when a Binance wallet infrastructure engineer downloaded a tampered Homebrew installer while trying to install an AI coding tool. Binance's security team caught it, replaced the device and rotated credentials. The incident still exposed information about the engineer's responsibilities and colleagues.
That detail didn't stay buried.
In September, someone impersonating a project director at a fictitious company approached another Binance software engineer through a legitimate recruitment platform. A person posing as an HR representative ran a live video interview (and shared a social media profile with personal photos and videos to build credibility), then a second interview followed with someone claiming to be the company's chief executive. The engineer was told to download a coding assignment onto his work computer.
It wasn't a real test. The repository contained malware that ran during setup, replaced a legitimate developer-tool component and connected to an attacker-controlled server. Binance said the previously unknown malware evaded its endpoint security software and hid traces of the intrusion.
From one laptop to wallet signing
By Oct. 20, the attackers had used the compromised computer and an internal AI tool to take control of two more engineers, including the employee targeted in June. They obtained a container deployment permission token. Nine days later, they used stolen credentials to deploy a malicious container and reach Binance's wallet-signing infrastructure, according to the report. Binance said the attackers started unauthorized transfers outside its normal withdrawal process and drained assets across several blockchain networks.
"We intercepted many of them, but the cost of failing to stop even one was severe—and this should never have happened." (Binance, Nov. 3 security report)
The FBI's TraderTraitor attribution
On Oct. 31, the FBI attributed the theft to North Korea's TraderTraitor operation, CryptoSlate reported, describing an ongoing effort to steal crypto and launder the proceeds through defi platforms.
It's a familiar playbook. In September 2024, the FBI warned that North Korean hackers were using highly personalized job offers, elaborate fake identities and long conversations to get inside crypto businesses, noting that even technically sophisticated employees could be fooled by campaigns tailored to their professional backgrounds. Binance's own list of techniques it saw this year includes fraudulent job interviews, fake developer tools, compromised packages and browser extensions, fake video conferencing apps and social engineering.
Frequently asked questions
How did attackers get into Binance's systems?
According to Binance's Nov. 3 security report, an engineer approached through a legitimate recruitment platform was told to download a coding assignment onto his work computer. The repository contained malware that ran during setup and connected to an attacker-controlled server, and Binance said it evaded its endpoint security software.
Who did the FBI say was behind the theft?
On Oct. 31, the FBI attributed the theft to North Korea's TraderTraitor operation, according to CryptoSlate. The agency described an ongoing effort to steal cryptocurrency and launder the proceeds through DeFi platforms.
