Binance stopped 57 North Korean cyber threats but fell for a fake job interview

Binance said it thwarted 57 suspected North Korea-linked cyber threats in 2026, yet a fake interview compromised one of its engineers.

The disclosure, in the exchange's Nov. 3 security report, reveals how attackers used a recruitment scam involving staged interviews, fabricated identities, and malicious software to access systems involved in the $6.34 billion cryptocurrency theft on Oct. 29.

Yi He, Binance co-CEO, said:

“Throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases. These attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry. The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware. We intercepted many of them, but the cost of failing to stop even one was severe—and this should never have happened.”

The operation succeeded despite Binance's security team identifying and preventing dozens of suspected North Korean intrusion attempts during the year, including campaigns using fraudulent job interviews and compromised developer tools.

The FBI attributed the theft to North Korea's TraderTraitor operation on Oct. 31, describing an ongoing effort to steal cryptocurrency and launder the proceeds through decentralized finance platforms.

Binance's findings expose a troubling gap between recognizing a persistent threat and preventing its execution.

The campaign's earliest identified stage occurred in June, when a Binance wallet infrastructure engineer downloaded a tampered Homebrew installer while attempting to install a popular AI coding tool.

Binance's security team detected the suspicious software, replaced the device, and rotated related credentials. However, the incident exposed information about the engineer's responsibilities and colleagues.

In September, someone impersonating a project director at a fictitious company approached another software engineer through a legitimate recruitment platform.

An individual posing as a human resources representative conducted a live video interview and shared a social media profile containing personal photographs and videos to establish credibility.