EXPLAINED | How Did a Fake Job Interview Help Hackers Raid Binance?

How did a job hunt become a route into Binance? The interview was for a job that did not exist. The access it helped criminals obtain was real.

Binance, an exchange where people trade and hold cryptocurrencies, says a fake recruitment process helped attackers compromise an engineer before its October 29 theft. The FBI attributes the theft of more than $6 billion to North Korea.

In September, an engineer seeking another job went through interviews that included a supposed chief executive. The engineer downloaded a malicious code repository, a collection of software files presented as part of the recruitment process. Reuters’ account of Binance’s findings describes this as one stage of a campaign involving several employees.

Why would a coding test be dangerous?

Because running unfamiliar software can give its author access to the computer running it.

A technical assignment can look like ordinary recruitment work. That is what makes this approach effective: the candidate expects to demonstrate programming skills, download a project and get it working.

The FBI warned in September 2024 that North Korean operatives research prospective targets, tailor employment offers to their interests and spend time building trust. Fluent English, technical knowledge and convincing professional profiles can make the approach credible. Even people familiar with cybersecurity can be vulnerable.

The warning specifically identifies pre-employment exercises that ask candidates to execute unknown software. A convincing conversation does not establish that the files supplied afterwards are safe.

Did that one download unlock billions?

Binance’s preliminary reconstruction describes a longer chain.

In October, attackers used a compromised computer and an internal AI tool to reach other engineers’ systems. Stolen credentials, information that grants access, helped them reach the service that signs transactions authorising asset movements.

That sequence matters. The interview helped establish access; additional compromises brought the attackers closer to the system controlling funds. The presence of an AI tool in that route does not establish that an autonomous AI agent decided to steal cryptocurrency.

Binance says independent security firms will review its findings. The unanswered question is how its access controls allowed that progression.

Why didn’t suspending withdrawals stop the theft immediately?

Because the attackers had obtained a route outside the ordinary customer-withdrawal process.

Binance says they abused Ethereum’s EIP-7702 mechanism to establish malicious permissions recorded on the blockchain. Those permissions required separate revocation. Pausing the exchange’s normal withdrawal service did not automatically cancel them.

Ethereum’s documentation explains that this mechanism lets an account use the functionality of another program, called a smart contract. The delegation can be removed. It is a legitimate feature whose permissions require careful handling.

The distinction is practical: stopping a company’s customer-facing service and cancelling authority already granted on a blockchain are separate actions.

Who does the FBI blame, and where did the money go?

The FBI names North Korean activity it calls TraderTraitor. North Korea rejects the attribution.

The agency says investigators observed stolen assets being converted primarily into ether, the cryptocurrency used on Ethereum. It expects further laundering through decentralised finance and instant-swap services. Laundering means trying to conceal criminal proceeds; decentralised finance uses blockchain-based programs to provide financial services.

The FBI has published linked wallet addresses and asked industry operators to block transactions involving them. Its alert does not disclose the full intelligence behind the attribution or establish that every stolen asset has already passed through the expected laundering routes.

Have fake interviews helped steal crypto before?

Yes. A separate Japanese case shows how the approach can also reach an exchange through a supplier.

In December 2024, the FBI and partner agencies attributed the $308 million DMM Bitcoin theft to TraderTraitor. Their account says an attacker posing as a recruiter contacted an employee of Ginco, a wallet-software company, through LinkedIn and supplied a malicious programming test.

Investigators said the resulting compromise enabled impersonation of the employee and access to internal communications. They assessed that the attackers likely manipulated a legitimate DMM transaction request.

This was a supplier-related route into a different company. It illustrates the wider exposure without establishing that every recruitment scam follows the same method.

How does this connect to India’s crypto losses?

WazirX provides a direct Indian connection.

A joint statement published by the US, Japan and South Korea says the US and South Korea attributed the approximately $235 million WazirX theft in 2024 to North Korea, based on industry analysis. It does not establish that WazirX was compromised through a fake interview.

For Indian technology workers and exchanges, the recruitment warnings are relevant independently of where a prospective employer claims to be based.

The FBI advises against running interview code on company laptops. It recommends independently checking a contact’s identity and using an isolated environment on a device unconnected to the employer’s network for tests requiring code execution. It also calls for separate approvals before company assets move.

Are Binance customers getting their assets back?

Binance says it will bear the financial loss. Replacing customers’ holdings and recovering the original stolen assets are different processes.

A separate November 3 notice confirms selected withdrawals reopened on November 1, with more being restored progressively. Availability depends on both the asset and the network used to transfer it. Customers are directed to check the withdrawal page for that combination.