Binance says it identified and stopped 57 suspected North Korea-linked cyber threats in 2026, yet a fake job interview still led to an engineer downloading malware and attackers reaching the exchange’s wallet-signing infrastructure. The company detailed the intrusion in a security report published November 3. On October 31, the FBI attributed an October 29 theft of about $6.34 billion in crypto assets to North Korea’s TraderTraitor operation. The incident highlights how hiring processes and developer environments can provide a route into crypto platforms, even when other threats are detected and blocked.
From a tampered installer to wallet-signing systems
Binance said the earliest related activity it identified took place in June. An engineer responsible for wallet infrastructure downloaded a tampered Homebrew installer while setting up a popular AI coding tool. After security staff detected unusual activity, Binance replaced the employee’s device and rotated relevant credentials. By then, however, the attackers had accessed information about the engineer’s role and colleagues.
In September, the attackers contacted another software engineer through a legitimate recruitment platform, posing as a project lead at a fictitious company. A person claiming to be a human resources representative then conducted a live video interview and shared social-media accounts containing personal photos and videos to appear credible. In a second interview, another person claimed to be the company’s CEO.
Near the end of the interview process, the engineer was asked to download a coding test to a work computer. The repository looked like a standard development project, but malware ran during installation, replaced components of legitimate development tools and connected to a server controlled by the attackers. Binance said the previously unknown malware evaded endpoint security software and concealed signs of the intrusion.
By October 20, the attackers had used the compromised computer and an internal AI tool to gain further control of two engineers’ devices, including that of the employee targeted in June. They then obtained a container deployment token. Nine days later, they used stolen credentials to deploy a malicious container and access Binance’s wallet-signing infrastructure.
Binance said the attackers bypassed normal withdrawal procedures to initiate unauthorized transfers involving assets on multiple blockchain networks. The company did not say how many of the 57 blocked threats involved fake interviews or whether any other cases were directly linked to the attackers behind the October incident.
Binance details its response
Binance co-CEO He Yi said the company’s security teams identified and stopped 57 suspected North Korea-linked cyber threats in 2026. The methods she listed included fake job interviews, malware disguised as widely used developer tools, tampered software packages and browser extensions, counterfeit video-conferencing apps, and social-engineering attacks designed to steal credentials or install remote-access malware. He Yi acknowledged that while many attacks were blocked, the failure to stop one had serious consequences, and said it should not have happened.
After the incident, Binance replaced affected employees’ devices, revoked exposed credentials and rebuilt the affected wallet infrastructure. The company also said it would strengthen protections for development environments and expand AI-based behavioral monitoring. Its report did not explain how these measures would specifically address the recruitment-interview stage used in this attack.
The recruitment tactic echoes known North Korean operations
The approach resembles tactics that security researchers and US law enforcement have tracked for years. In September 2024, the FBI warned that North Korean hackers used highly tailored job offers, carefully constructed false identities and sustained communication to infiltrate cryptocurrency companies. Employees with strong technical skills could still be targeted with scams designed around their professional backgrounds.
In June 2026, Kudelski Security researchers documented an operation called “Contagious Interview,” in which attackers posed as recruiters on LinkedIn, WhatsApp and Discord before persuading developers to run malicious code. In September, Atlassian researchers identified fake technical assessments hosted on established development platforms, with malicious instructions concealed in projects that appeared legitimate.
The cases show how attackers use recruitment processes and developer tools to establish trust before expanding access to corporate systems. Binance’s account also indicates that the June device infection did not prevent attackers from later exploiting employee connections and internal tools to broaden their access. The company has not disclosed the breakdown of the 57 blocked threats or identified which safeguards failed in this incident. It has confirmed that the intrusion reached wallet-signing infrastructure and led to unauthorized transfers across multiple blockchain networks.