A Fake Job Interview Cost Binance $6.34 Billion

The biggest cryptocurrency heist in history didn’t start with a server bug. It started with a job offer. On November 3, 2026, Binance published its preliminary report on the October 29 attack, in which it lost about $6.34 billion in digital assets.

The FBI attributes the theft to TraderTraitor, a North Korean hacking operation linked to the Lazarus Group (North Korea denies it). The most striking part of the report: the way in was a Binance engineer who believed he was in a legitimate hiring process.

How it happened, step by step

This was no quick hit: the operation took about five months, from June until the theft.

1. The bait. A Binance engineer had his profile on a job platform. Someone posing as a project director reached out about a role.
2. Building trust. There was a video call with a supposed recruiter, with a real face, who even shared social media accounts full of photos and videos of a seemingly genuine life.
3. The “CEO”. In the second round, the conversation moved to a messaging app with someone claiming to be the CEO. The company didn’t exist.
4. The coding test. At the end, he was asked to download a code repository as an exercise. He ran it on his work computer.
5. The trojan. During setup, a script silently replaced pyenv, a common tool for managing Python versions, with a malicious copy. That copy took orders from an attacker-controlled server and erased its own traces. Binance’s security tools didn’t catch it right away.
6. A warning that came too late. The security team eventually detected the malware, replaced the device and rotated credentials. But the attackers already knew who the engineer was and who worked with him on the wallet team.
7. Moving inside. On October 20, they used a compromised internal AI tool to reach the machines of two other engineers.
8. The heist. On October 29, they used one of those machines and a key belonging to the first engineer to send unauthorized withdrawals. An alert about unusually large transfers exposed the attack.

Why it worked

The attack combined two weaknesses almost every tech company has: trust in people and trust in development tools.

• Patient social engineering: several rounds, people with faces and social lives, a company with a “CEO”. Each step made the next one more believable.
• An ordinary request: for a developer, running a coding test is routine. That normality was the weapon.
• The work machine as a bridge: the code didn’t run on an isolated machine, but on one connected to the company network.
• Malware hidden in a trusted tool: replacing pyenv, something used every day, made it invisible.
• An incident that wasn’t really closed: replacing the device and keys didn’t erase what the attackers had learned about people and infrastructure.

It isn’t an isolated case: Binance says it blocked 57 other attempts attributed to North Korea in 2026, many using similar lures.

What to learn from this

The core lesson: never run a stranger’s code on a work machine, no matter how legitimate the sender looks.

If you’re a developer:

• Run coding tests only in a virtual machine, a container or a disposable cloud environment.
• Read install scripts (setup.py, postinstall, Makefile) before running them.
• Verify the company through independent channels: official site, business registry, real employees.
• Be wary when the process switches platforms midway or you’re being rushed.

If you run a company:

• Keep development machines separate from critical systems (payments, customer data, production).
• Apply least privilege and strong authentication on every sensitive access.
• Monitor the integrity of tools and dependencies, not just antivirus alerts.
• After an incident, assume the attacker is still informed and review the people exposed too.
• Train your team: social engineering targets people, not servers.

Security starts at the design stage

Binance could absorb the blow: it covered more than 98% of the losses with its own funds and has frozen or intercepted about $2.85 billion. A small business wouldn’t have that safety net.

At DeltaApps we build every application with security baked in from day one: separate environments, minimal access, dependency reviews and good practices for the team that uses it. If you want to check how protected your business is, let’s talk.

Sources: BleepingComputer, The Register, Yahoo Finance, SBS News, CNN.