Binance, one of the world's biggest crypto exchanges, lost about $6.3 billion US. Cointelegraph calls it the largest crypto hack in history. A big part of how the attackers got in was a fake job interview.
You don't run a crypto exchange. Doesn't matter. The trick works on anyone with a laptop and a LinkedIn profile.
What happened
Binance published a report on November 3 laying out how the attack unfolded. The short version, from Cointelegraph and Finance Magnates:
June: An engineer was setting up an AI coding tool and downloaded a tampered software package after clicking an online ad. Binance caught it and replaced the computer, but the attackers had already learned about the team that works on Binance's crypto wallets.
September: Fake recruiters on a job-hunting site approached a second engineer, posing as a company that doesn't exist. People pretending to be that company's executives interviewed him. Then he got a "coding assignment." It was malware. He ran it on his work computer, and Cointelegraph reports it got past Binance's security protections.
October 20: Using that computer and an internal AI tool, the attackers got into two more engineers' systems and picked up the passwords used to change Binance's wallet systems.
October 29: They used those to plant their own code in the system that approves crypto transactions, and moved the money out.
The FBI blames TraderTraitor, a hacking group linked to North Korea. Finance Magnates notes the same group was tied to the $1.5 billion Bybit theft in February 2025. North Korea denies it.
Binance says it will cover the losses, not its customers.
What this means in plain English
Think of a con artist who doesn't bother picking the lock. He asks you to carry a box into the building for him. The guard waves you through because you work there.
That's what a malware "coding test" is. The employee runs it, on a trusted work computer, signed in to work systems. From there the attacker can look around, grab saved passwords, and wait.
They waited months, until they could act like a real Binance engineer.
Why a small business should care
People job hunt on company laptops. Everyone knows it, nobody puts it in the policy.
You probably don't hold billions in crypto. But your staff's work computers can reach your bank login, your accounting software, your customer files and your email. Getting into one of those is worth a lot to a criminal, even a much less fancy one than North Korea.
Then there's the second wave. Bitdefender found phishing emails using the Binance news within days. One offered "compensation" in exchange for a small "verification fee." Another pretended to be from Trust Wallet and pushed people to click a button to "verify" their address. Binance itself warned on X that scammers would offer to speed up withdrawals or help people claim compensation for a fee. Plenty of staff have a crypto account on the side, so expect these in work inboxes.
Who's affected
Binance customers, directly.
Anyone who gets a job offer, recruiter message or "test" to download. That's everyone on your payroll at some point.
What to do: everyone
Never run a "test," "assignment" or "sample project" from a recruiter on a work computer. If it's real, it'll still be real on a personal machine, or the recruiter can use a website test instead.
Be suspicious of any job process that ends with "download and run this."
Ignore any message offering Binance compensation, priority withdrawals or "verification." Binance says it will never contact users first about accounts or funds and won't charge fees to unlock anything.
Never send crypto to "unlock" a refund. Never share a recovery phrase or a sign-in code.
If you have a crypto account, go to it by typing the address yourself or using the official app. Don't click the link in the email.
What to do: if you run the business
Put it in writing: no outside software, tests or downloads from recruiters on work machines. People job hunt. Say it plainly instead of pretending they don't.
Give everyday staff accounts that can't install software. If they can't install whatever lands in Downloads, a lot of this goes nowhere.
Questions to ask your IT provider
Can our staff install software on their own work computers right now?
Would our security software have caught a fake "coding test," or are we just hoping?
If one laptop got infected, what else could it reach?
Sources
Cointelegraph: Binance traces $6.3B hack to fake job interviews, compromised AI tool
Finance Magnates: Binance Hack Began with Fake Job Interviews, Ended with $6.3 Billion Stolen
Bitcoin.com News: Binance Warns of Fake Compensation Offers as Withdrawals Resume
Bitdefender: Binance breach news is already being used in crypto phishing emails, Bitdefender Labs warns
Contact Nautalex to see how we can help you with protecting your staff from scams.
