Chainalysis: North Korean fake recruiters banked $14.3M before Binance breach

Chainalysis has tied more than $14.3 million in crypto thefts over the past 18 months to the North Korean fake-job-interview playbook that eventually landed on Binance's doorstep. The blockchain analytics firm says those smaller hits were rehearsal — the warm-up act for a $6.3 billion score.

The pattern is deceptively simple. Targets — from solo wallet holders to protocols and DAOs — get approached by fake recruiters, go through interview rounds, then run an assignment laced with malware. Tom McLouth, a senior intelligence analyst at Chainalysis, said the firm has spotted dozens of these interview compromises leading to wallet takeovers, with individual losses stretching from tens of thousands of dollars up to millions. The crews were, in his words, perfecting and evolving the methodology — and that's how you end up with the biggest heist in history.

Binance traced its own breach back to a September interview invite sent to an engineer, who downloaded a poisoned assignment after two rounds with a fake company, Cryptopolitan reported. Chainalysis Senior Manager of Global Services Alec Zebrick calls the tactic “contagious interviews,” aimed squarely at staff with privileged access so their credentials can be turned on their own employer. Some victims found private keys lifted from cloud storage — even when their seed phrases never touched the infected machine, a clue Chainalysis says points to stolen cloud logins or hijacked browser sessions.

Microsoft's Defender Experts team documented a Contagious Interview campaign running since at least December 2022, with fake recruiters posing as crypto trading or AI firms. Once inside, the malware hunts for wallet mnemonic phrases, KeePass and 1Password vaults and cryptographic keys, according to Microsoft.

Chainalysis also reports blockchain-enabled cyberattacks up fivefold in 12 months — a trend it labels Blockchain Dead Drops, powered by nation-state actors and possibly open-weight AI models. North Korean operators started using a technique called “Etherhiding” in early 2025, hiding command-and-control instructions on-chain because a blockchain record is tougher for police to seize than central hosting. One setup split instructions across TRON and Aptos, with both chains pointing to a payload hosted on BSC; Aptos serves as the fallback if TRON fails. A newer “null receiver” trick tucks commands inside a specially crafted, uncontrolled address that infected machines read as orders.

In September, the FBI, Japan's National Police Agency and agencies in Australia and Germany publicly blamed a North Korean crew called WaterPlum — also known as Contagious Interview — for a heist worth about $10.71 million, hitting sensitive data on roughly 7,000 crypto accounts. The FBI pinned the Binance attack on the North Korean group TraderTraitor, while Pyongyang denied any involvement. Chainalysis expects the stolen funds to keep moving in the days ahead.