Binance's $6.3B loss shows fake interviews beat endpoint controls

Binance says North Korean hackers stole a record $6.3 billion after posing as recruiters and persuading one of its wallet engineers to open a malicious coding assignment on a work laptop. That single file started a chain of compromised machines that ended at systems controlling billions in crypto. Social engineering gave the attackers a foothold; the exchange's own internal tooling carried them the rest of the way.

The exchange published its account on X. TechCrunch reported that North Korean hackers posing as recruiters contacted a software engineer on the wallet team. After two interviews, the engineer was told to download what looked like a coding assignment. It carried malicious code, and Binance says its security tools did not detect it.

How one laptop reached the wallets

Read the sequence as a series of permissions, not a series of tricks. According to TechCrunch, the first compromised laptop gave the attackers access to an internal tool capable of taking over the work computers of two other wallet engineers. One of those engineers had, months earlier, downloaded a tampered app after finding it through search results, and that app carried password-stealing malware.

Binance replaced that engineer's laptop, but the stolen credentials were still valid. The hackers used them to get into a third engineer's machine, and that engineer's role touched systems able to control billions in crypto. Three people, three machines, and a tool that let one compromised endpoint reach others.

For any team with privileged access, that is the link to audit first. A remote-control capability that works laterally between engineers' machines turns one bad download into a fleet problem. Replacing hardware without rotating credentials treats the device as the incident when the secret was the incident.

The social engineering was patient, and it was documented

BleepingComputer's account adds texture. It reports that the approach began in September through a legitimate job-hunting platform, with someone impersonating a Project Director at a fictitious company. The first interview was with a supposed HR representative, the second with someone claiming to be the CEO. In the first call, the fake HR contact shared a social media account with personal photos and videos to build trust. None of that is sloppy. It is a staged hiring process with two people playing roles.

It is also a known playbook. BleepingComputer notes these tactics are associated with North Korean campaigns tracked as Contagious Interview and Operation Dream Job. The Hacker News reported in early 2025 that the activity overlapped with DeceptiveDevelopment, with fake recruiter profiles sending trojanized codebases hosted on GitHub, GitLab or Bitbucket under the pretext of an interview. ESET's research from September 2025 described initial access as coming exclusively through social engineering, including fake recruiter profiles on LinkedIn, Upwork, Freelancer.com and Crypto Jobs List.

The warnings kept coming this year. Cointelegraph reported in September on a joint advisory from Japan, Germany, Australia and the US about WaterPlum, the same cluster also known as Contagious Interview. The advisory counted at least 30,000 infected devices across more than 100 countries and at least $10.7 million stolen. VOA's summary of the guidance was blunt: be suspicious when an unfamiliar recruiter asks you to run code or download a project during an interview.

Binance itself says it faced at least 57 suspected attacks from North Korea. So this was not a surprise vector. It was a known one, aimed at a team whose laptops sat close to the money.

Why training alone did not stop it

The easy reading is that one engineer should have known better. TechCrunch's reporting points the other way: it is ultimately the company's job to make sure its systems cannot run unauthorized or untrusted software. A control that depends on a job seeker declining a plausible coding test is a control that fails at a predictable rate, especially when the person is being recruited by a convincing CEO impersonator over video.

Binance said the attack should not have happened and that it has improved its network security. TechCrunch says a spokesperson declined to answer on the record how the company prevents unauthorized or malicious code from running on employee laptops, or whether third parties had audited its network before the hack. Those two questions are the right ones. The answers would show whether this was a detection gap, an allowlisting gap, or a privilege design gap.

For a smaller operation, the translation is not exotic. It comes down to a few specific changes:

• Run interview coding tasks, and anything else from an outside party, in a disposable VM or a cloud sandbox, never on a machine with production credentials.
• Keep people with access to money or customer data on devices that cannot install arbitrary software, and make the exception path slow on purpose.
• Treat a replaced laptop as the start of credential rotation, not the end of the ticket.
• Scope remote-management tooling so that one endpoint cannot reach another team member's machine.

The search-result detail deserves its own line. One engineer got password-stealing malware from a tampered app found through a search engine. That is a plain software-sourcing problem. If your team installs tools by googling them, the fix is an approved list and a package source you control, not a reminder email.

What this means if you run a small team

You are not holding $6.3 billion, but you probably have the same shape of exposure at a smaller scale: a few people with admin access to ad accounts, payment processors, a CRM, a hosting panel or a domain registrar, working on laptops that also open attachments and test-drive new apps. The attacker's economics are identical. They need one person with one useful credential, and they will spend months getting it.

Hiring is now an attack surface you should account for. If your team posts jobs, interviews candidates, or gets approached by recruiters, decide where untrusted files are allowed to open and write that rule down. The same goes for freelancers you onboard. AÉNL Agency sets up these safeguards for small teams, from sandboxed review machines to scoped access around automations and tools. A 30-minute consultation maps who can touch what and where the gaps are.

The headline number will fade. The mechanism will not: a patient approach, a plausible task, a laptop with too much reach, and a credential that outlived the device it was stolen from. Fix the reach and the credential lifetime first, because those are the parts you control.

For more write-ups like this, there is the AÉNL Agency newsletter.