Months before Binance suffered a $6.3 billion hack, its chief security officer described a fake job interview tactic that could give attackers a foothold inside the exchange. The warning, given to Cointelegraph in July, now looks closer to the entry path used in the October theft.
A fake coding test became a real security problem
Jimmy Su said fake job interviews were something Binance worried about internally. The idea was simple and nasty: attackers tailor a job offer to an employee, then persuade the person to run code as part of a technical assessment. If the code executes, the device is compromised and credentials can be harvested. From there, an attacker can move deeper into the network.
Su also explained why security tools might miss it. A coding task can involve legitimate-looking steps, such as downloading a code repository from GitHub. Each step may look normal on its own, so anti-virus tools may not flag it. Binance’s later investigation described a similar failure. A software engineer downloaded a malicious coding assignment onto his work computer in September during a fake interview. That compromise became part of a multistage attack that ended in October’s theft, according to Binance’s preliminary findings.
The company says it has to catch the risk
Su said employees can explore outside opportunities, but Binance worries when they do so on company devices. If an employee falls for a fake interview, he said the onus is on Binance to detect it and stop the code from executing. The exchange had already been testing staff against fake recruiters. Its internal red team ran monthly phishing simulations for three to four years, with remedial training for those who failed. Early security habits were not great, Su said, but the company improved over time.
Recruiters are watching the threat change hiring checks too. Kevin Gibson of Proof of Search said some crypto clients now ask whether a candidate has been met in person. A candidate seen by a third-party recruiter may have an edge. In crypto, a shady job offer or a quick catch-up call can be the first step in a large theft, he said.
Binance reports more North Korea-linked threats
Binance said it blocked 57 suspected North Korea-linked cyber threats this year, roughly one every five days. After the October attack, it tightened device controls, rebuilt affected wallet systems and internal AI tooling, strengthened access controls, and revoked compromised credentials. It also said it would spend more on endpoint protection and developer-environment security and bring in independent experts to review the incident. Some technical details will stay confidential.
