Binance Security Chief Flagged Fake-Job-Interview Trap Before $6.3B Hack

Binance's chief security officer described the exact playbook months before it hit. In a July interview with Cointelegraph, Jimmy Su said fake job interviews were 'something we worry about a lot internally,' explaining how attackers could tailor a job offer to an employee and then persuade them to run code during a technical assessment. 'And once that gets executed, the device is compromised and then they can start harvesting credentials,' Su said, adding that attackers could use those credentials to push deeper into the network.

That warning never made it into Cointelegraph's July coverage. It reads differently now. In September, a Binance software engineer downloaded a malicious coding assignment onto his work computer during a fake job interview, according to Binance's preliminary investigation. That compromise became one link in the multistage attack that ended in October's theft of $6.3 billion — the largest hack in crypto exchange history.

Su had already sketched out why standard defenses would fail. A technical assessment can involve steps that look clean on their own, like pulling a code repository from GitHub. 'Each step is actually legitimate on its own. So a lot of the anti-virus tools may not be able to detect it and flag it,' he said. Binance's investigation later described the same blind spot, saying the assignment's setup process ran malware that slipped past endpoint security through obfuscation and other evasion techniques.

The CSO was blunt about where responsibility sits when staff chase outside opportunities on company hardware. 'Of course employees can explore outside opportunities. What we do worry about is that they do so on the company device,' Su said. If someone falls for a fake interview, he added, 'the onus is on us to detect it' and to 'stop the actual execution of that code.' Binance's internal red team has run monthly phishing simulations for three to four years, with remedial training for employees who fail. 'In the beginning, the security hygiene left a lot to be desired. But after this amount of time, the company has improved significantly,' Su said.

The tactic is reshaping hiring checks across crypto. Kevin Gibson of recruitment firm Proof of Search told Cointelegraph that clients increasingly ask whether a candidate has been met face to face, and that applicants personally vetted by a third-party recruiter carry an edge. 'In crypto, a dodgy job offer or a quick catch-up call can be the first step in a multimillion-dollar hit,' he said.

Binance says it has blocked 57 suspected North Korea-linked cyber threats this year — roughly one every five days. After October's attack, the exchange said it tightened device controls, rebuilt affected wallet systems and internal AI tooling, strengthened access controls and revoked compromised credentials. It's also pouring more into endpoint protection and developer-environment security and bringing in independent cybersecurity experts, while keeping some technical details and security measures confidential.