Binance stopped 57 North Korean cyber threats but fell for a fake job interview
Binance revealed it prevented 57 suspected North Korean-linked cyber threats in 2026, yet a fake job interview still compromised one of its engineers, leading to a $6.34 billion cryptocurrency theft.
The disclosure, in Binance's Nov. 3 security report, reveals how attackers used a recruitment scam involving staged interviews, fabricated identities, and malicious software to access systems involved in the massive theft on Oct. 29. Despite the security team's success in preventing 57 suspected North Korea-linked cyber threats, the operation succeeded, highlighting a troubling gap between recognizing a persistent threat and preventing its execution.
How a fake interview breached defenses
The campaign began in June when a Binance wallet infrastructure engineer downloaded a tampered Homebrew installer while attempting to install a popular AI coding tool. Although Binance detected the suspicious software, replaced the device, and rotated credentials, the incident exposed information about the engineer's responsibilities and colleagues.
Related
