Binance’s record $6.3 billion hack on October 29 was preceded by a social-engineering tactic that its own chief security officer, Jimmy Su, had publicly described months earlier. In a July interview with Cointelegraph, Su warned that fake job interviews were a major concern for the exchange, explaining that attackers could tailor a job offer to an employee and ask them to run code as part of a technical test.
According to Binance’s early investigation, a software engineer downloaded a malicious coding assignment onto his work computer in September during a fake job interview. That download became the entry point for a multistage attack. The theft itself took place on October 29 and, according to Reuters, unfolded in minutes after months of planning. Experts have linked the attack to an elite North Korea-linked hacking group.
Su had cautioned that once the code is run, “The device is compromised and then they can start harvesting credentials,” allowing attackers to move deeper into the network. He added that antivirus tools might not detect such a trap because downloading code from GitHub can appear normal. Binance’s investigation described a similar failure: the assignment’s setup process ran malware that avoided the exchange’s endpoint security tools through hiding techniques and other evasion methods.
Su said employees can explore outside opportunities, but the risk is doing so on company devices. “What we do worry about is that they do so on the company device,” he said, adding that if an employee fell for a fake interview, “the onus is on us to detect it.” Binance’s internal red team has run monthly phishing tests for three to four years, with employees who fail receiving extra training.
Industry experts questioned why exchanges lack stronger internal safeguards. Jonathan Alexander, chief technology officer of S&P Global’s OpenZeppelin, said social engineering is well known and the bigger issue is stopping an attacker from gaining wider access after breaching one computer. Alex Pruden, CEO of Project Eleven, said defenders face a basic disadvantage because attackers only need to succeed once. Kevin Gibson of recruitment firm Proof of Search said hiring is changing, and clients now ask whether recruiters have met candidates in person.
Chainalysis data shows more than $22.3 billion has been stolen from crypto platforms since 2021. Unlike banks, US exchanges do not follow a single federal cybersecurity system; rules depend on state licenses. New York’s Department of Financial Services requires licensed firms to maintain cybersecurity programs, use multi-factor authentication and name a chief information security officer, while other states mainly apply money-transmitter rules without specific technical controls.
Binance said it blocked 57 suspected North Korea-linked cyber threats this year, roughly one every five days. After the attack, it tightened device controls, rebuilt affected wallet systems and internal AI tooling, strengthened access controls, revoked compromised credentials and hired independent experts to review the incident.
