A fake job interview led to a $6.3 billion Binance heist. Is your team next?

On 29 October 2026, Binance lost between $6.3 and $6.4 billion. The attack started with a fake job interview. An engineer was given a coding "assignment" and ran it on a work laptop. The FBI blames North Korea's TraderTraitor group.

Developers run coding tests without a second thought, which is exactly why attackers use them. You can close this door with a few simple rules. Never run unknown repositories on work machines. Use a throwaway environment for any take-home task. And never ask your own candidates to do the same.

Key facts

In this article

• What happened at Binance, interview by interview?
• How big was it, and what came back?
• How does a coding assignment take over a work laptop?
• Is this a one-off, or a campaign aimed at developers?
• What should an engineering team change this week?
• Does your own hiring process teach developers to run code from strangers?
• Where RocketDevs fits
• Conclusion
• Frequently asked questions

What happened at Binance, interview by interview?

In September, a Binance engineer took part in a fake job interview and ran the "assignment" on a work computer. Weeks later, attackers moved between $6.3 and $6.4 billion out of Binance wallets. The FBI had attributed the theft to North Korea on 31 October. Binance gave its own account of the attack on 3 November.

Everything in the interview chain below comes from Binance's incident report. No outside party has confirmed it, so read each step as Binance's account.

June: a tampered Homebrew install

The first attempt came three months earlier. In June, a wallet DevOps engineer went looking for an AI coding tool through a search engine. He ended up downloading a tampered Homebrew installation. Binance's security team spotted the anomaly, replaced the device and rotated the related credentials.

That was not enough. The attacker now knew the engineer's role, and who his colleagues on the wallet infrastructure team were. Cleaning one laptop does not erase the fact that someone knows who holds the keys.

This kind of trap is real and well documented. On 30 April 2026, the SANS Internet Storm Center described a malicious ad that led to a fake Homebrew page, which pushed a stealer called MacSync. That report has no link to Binance. Treat it as an example of the technique, not as the June incident.

September: the approach

In September, someone posing as a Project Director contacted a Binance software engineer on a legitimate job-hunting platform. The engineer's profile mentioned his time at Binance. The Project Director then arranged two interviews with a fictitious company.

The first round: a video call that builds trust

The first round was a live video interview with a purported HR representative. The interviewer shared a social media account with personal photos and videos, "in order to build trust." Binance says this was more advanced and deceptive than earlier approaches it had seen.

The FBI's September 2024 alert describes the same craft. It says these actors usually hold long conversations to build rapport before they deliver malware.

The second round: the assignment

The second interview took place in a popular chat app, with someone claiming to be the CEO. Near the end, the engineer was told to download an "assignment" onto his work computer. It contained a malicious code repository.

The code ran during setup. Binance says the malware swapped a legitimate development tool component for a malicious one. It then contacted an attacker-controlled server and covered its tracks. Binance calls it 0-day malware, meaning it was new and unknown, and says its endpoint security tools did not detect it at the time.

20 October: an internal AI tool as a springboard

On 20 October, the attacker used the compromised laptop and an internal AI tool to take control of two more engineers. One of them was the DevOps engineer from June. He had a container deployment token on his computer, and the attacker found it.

29 October: the theft

Binance says the attacker logged on to a third engineer's computer on 29 October, between 17:15 and 19:56. Using the DevOps engineer's stolen credentials, the attacker deployed a container and ran a malicious script to launch the attack.

The money left fast. TRM Labs says most of it moved in about 20 minutes, starting at 20:05 UTC. Binance's report says five hot wallets sent 233.46 million XRP between 20:05 and 20:09. Binance describes unauthorized access to an internal wallet signing service. That access let transactions bypass the normal withdrawal process. TRM's on-chain analysis points to the same weakness.

The preparation started earlier. TRM says it began at least 36 hours before the theft. Elliptic saw three small Tornado Cash withdrawals fund a fresh attacker wallet. On Ethereum, the attacker then submitted one transaction carrying 50 signed authorizations. This made sure the transaction count would match the hot wallet's count when it landed.

How big was it, and what came back?

The four measurements agree on the scale but differ on the decimals. Binance counts about $6.34 billion. TRM Labs says $6.36 billion, valuing each transfer at the moment it was taken. Chainalysis says about $6.4 billion, and Elliptic says $6.43 billion. The FBI says only "more than $6 billion." The spread comes from method, so the sensible figure to quote is a range.

As of 1 November, Elliptic had verified $2.85 billion as frozen or seized. That is 44 percent of the theft, and almost all of it is stablecoins. The rest is being swapped into assets that no issuer can freeze.

After withdrawals resumed, Binance told The Register it recorded about $3.64 billion in net outflows. It says this is around 2.1 percent of its reported assets.

On attribution, TRM, Chainalysis and Elliptic each pointed to TraderTraitor from on-chain evidence before the FBI alert. Chainalysis saw funds from Binance mix with funds from the Bitget theft, which had been attributed to North Korean actors. North Korea has denied involvement, dismissing the U.S. announcement as "a trite provocation," according to the Associated Press on 2 November.

How does a coding assignment take over a work laptop?

It runs before anyone reads it. Package managers, editors and version control all run code at install, open or checkout time. So setting up a project is already running it.

What does a swapped pyenv give an attacker?

Pyenv is a version manager for Python. It works by placing a folder of shims at the front of your PATH. A shim is a small program that passes your command along to pyenv. The pyenv README explains that PATH folders are searched from left to right, so a program at the start of the list wins over one at the end. That means pyenv's shims answer for every python command you type.

This design makes pyenv a good place to hide. Whoever controls pyenv or its shims sees every Python command you run, and nothing looks different. The project has been public on GitHub since 2012 and has about 45,000 stars, so a pyenv in your PATH looks perfectly ordinary.

Binance has shared the steps of the attacker's script. It creates a file next to the real pyenv in the Homebrew folder (version 2.8.0), writes new content into it, and deletes the valid pyenv. It then renames the new file into place, deletes the link in the Homebrew bin folder, and creates a new link. Finally, it starts a zsh shell.

The paths match Homebrew's default layout for Apple Silicon Macs, which uses /opt/homebrew as its prefix. That points to a Mac. Binance does not say what language the assignment used or how the replacement was triggered. So do not assume it was a Python or npm project.

Why installing the dependencies is not safe

The npm documentation lists the lifecycle scripts that run on install, and its configuration page confirms that ignore-scripts defaults to false. VS Code documents that a task can run when a folder opens. It also says automatic tasks never run in an untrusted workspace, and that an unfamiliar folder opens in Restricted Mode by default. The Git documentation adds the checkout hook.

This is common, everyday behavior. Husky updates the prepare script in package.json when you set it up. About 49.7 million copies of it were downloaded from npm in the week of 1 to 7 November 2026. Install-time code is normal.

Attackers know this. A peer-reviewed dataset of 174 malicious packages used in real attacks on npm, PyPI and RubyGems shows how such code gets executed. A study of 1.63 million npm packages proposed install scripts as a warning sign and found 11 malicious packages that way. A detector run on 96,287 npm package versions from a single week found 95 previously unknown malware samples.

North Korea-linked actors use the technique at scale too. In June 2026, Microsoft Threat Intelligence attributed an npm compromise to Sapphire Sleet with high confidence. It hit more than 140 packages in the Mastra family. Microsoft said any developer machine or CI pipeline that ran npm install or npm update afterwards was potentially exposed, whether or not the package was ever imported.

For the same principle applied to editor extensions, see our piece on vetting IDE extensions. The lesson is the same: code runs with your permissions before you read it.

Is this a one-off, or a campaign aimed at developers?

It is a campaign. The FBI has described its signature since 2024: a request to take a pre-employment test or debugging exercise that runs unknown Node.js packages, PyPI packages, scripts or GitHub repositories. That is the FBI's own list of warning signs for North Korean social engineering, and Binance's report fits it.

The record is long. Each step below comes from the agency or company that published it.

• 2019 and 2022: The U.S. Treasury says OFAC sanctioned the Lazarus Group on 13 September 2019 and updated the group's entry on 14 April 2022. Wikipedia describes the group as allegedly run by the North Korean government. The FBI uses the name TraderTraitor for the activity.
• April 2022: A joint advisory from the FBI, CISA and Treasury described this activity against cryptocurrency companies, going back to at least 2020.
• November 2023: Palo Alto Networks' Unit 42 published on Contagious Interview. In this campaign, actors contact software developers on job platforms, pose as an employer and invite them to an online interview.
• March to May 2024: The FBI, DC3 and Japan's police report that an actor posing as a LinkedIn recruiter contacted an employee at Ginco, a Japanese wallet software company. The actor sent a link to a Python script presented as a pre-employment test. The theft that followed was $308 million from DMM.
• September 2024: The FBI published its alert on well-disguised social engineering aimed at crypto-industry staff.
• November 2024:Microsoft described Sapphire Sleet posing as a recruiter on LinkedIn.
• February 2025: The FBI attributed the Bybit theft, roughly $1.5 billion, to TraderTraitor. Google's Threat Intelligence Group has tracked a group called UNC5342 inside the Contagious Interview campaign since that month.
• 2026: Binance says its security team detected and prevented 57 suspected North Korea-linked cases this year. These included fraudulent interviews and malicious tools disguised as developer software.

Two things follow from this record. First, the target is the developer, because a developer holds the credentials and runs code for a living. Second, the lure works on competent people. The FBI says "even those well versed in cybersecurity practices can be vulnerable." A reminder to be careful is not a control.

The Register's story drew 658 points on Hacker News on 4 November. The obvious question is why an engineer ran an interview task on a work machine. It is a fair question, but it is the wrong place to stop. A policy that depends on every developer making the right call every time will fail at some point.

If you worry about the opposite problem, a fake candidate, our guide to verifying a remote developer's identity covers that. This piece covers a fake employer.

What should an engineering team change this week?

Three rules cover most of the risk. Keep unknown repositories off work machines. Run exercises only in a throwaway environment. Check every recruiter on a second channel. The FBI says the same in its own words: "Avoid taking pre-employment tests or executing code on company owned laptops or devices." If a test needs code execution, the FBI says to insist on a virtual machine on a non-company device, or on a device the tester provides.

The sixth change comes from the Binance chain rather than from an agency. The attacker found a container deployment token on one engineer's computer and used it to deploy the malicious container on 29 October. A token that lives for an hour is worth far less to an attacker than one that lives for months.

The FBI also recommends limiting access to sensitive code and pipelines, and moving business communication to closed platforms. Binance says it replaced the affected devices and decommissioned the credentials and tokens tied to the engineers. It also says it tightened device controls.

What if someone already ran it?

Treat the machine as compromised. The FBI says to disconnect it from the internet at once and leave it powered on, so the malware artifacts can still be recovered. Then rotate every credential that machine could reach. Check what the person's colleagues can reach as well. In June, Binance rotated credentials and still found the engineer's role exposed.

Our guides to responding to a critical vulnerability and to the contractor offboarding access checklist give the rotation steps.

Does your own hiring process teach developers to run code from strangers?

Probably, if you send candidates a repository and tell them to run it. The FBI lists exactly that request, a pre-employment test that runs packages, scripts or repositories, as a sign of an attack. From the candidate's chair, your honest process and the attacker's fake one look the same.

That is the uncomfortable mirror. Every time you send a take-home that says "clone this and run the setup script," you train your candidates to do what Binance's engineer did. Some of them will do it on a work laptop, because they interview on their lunch break.

The FBI lists two other warning signs that a legitimate employer can trip by accident. One is a request to run a script that enables call or video features that supposedly do not work in the candidate's location. The other is insisting on custom software for something a common application already does. If your process asks for either, change it.

How do you run a take-home that never runs on a candidate laptop?

Host it. A GitHub codespace is hosted by GitHub in a Docker container on a virtual machine. The candidate works in a browser, and nothing runs on their laptop. A VS Code dev container with an isolated volume gives a similar boundary on your own hardware. Either way, the exercise should hold no credentials and no production code. It should also have no network paths into your systems.

Better still, review the work live. A shared session on your own machine, using a repository you wrote, needs no code to run on the candidate's side. Ask candidates to explain the code, not to run yours.

Tell candidates what you will do, too. Name the person who will contact them and the channel they will use. Say that you will never ask them to install anything. A real recruiter can send that note in one line, and a fake one cannot be sure to match it. It also gives the candidate a way to check you on a second channel, which is the FBI's own advice.

A short policy on your hiring page does the rest. It should state that no candidate will be asked to run code on a personal or work computer. It should say that exercises run in a hosted environment. And it should promise that you confirm every contact by video on a second channel.

Where RocketDevs fits

Our vetting takes 6-8 hours per developer, and we accept only the top 2% of applicants. After this month, vetting should also look at how a candidate treats a stranger's code. The same goes for you: candidates should be able to look at how you run your own take-home.

If you hire through us, you get a 14-day risk-free trial, with your money back if it does not work out. That gives you time to see how a developer handles access and credentials before you commit.

Binance's engineer was approached with a real-looking job. The best defence is a team that treats a coding assignment from a stranger the way it treats an unknown attachment. It also needs a hiring process that never pushes candidates to break that habit.

Conclusion

The Binance theft did not start with a clever exploit. It started with a job offer, a friendly video call and a coding assignment. The engineer ran it like any other task, and that was all the attacker needed.

This will happen again. The campaign has run since at least 2020, it targets developers, and it works on skilled people. Hoping that every engineer makes the right call every time is not a plan.

A better plan is simple and fits in a week. Keep unknown code off work machines. Run every exercise in a throwaway environment. Confirm every recruiter on a second channel. Keep deploy tokens short-lived and off everyday laptops.

Then look at your own process. If you ask candidates to clone a repository and run it, you are teaching them the habit that attackers rely on. Host the exercise, review the work live, and tell candidates exactly how you will contact them.

Treat a coding assignment from a stranger like an unknown attachment. Do it as a team rule, and do it before the next "recruiter" arrives.

Frequently asked questions

How do fake job interview scams work?

A fake job interview ends with a request to run something. The FBI lists a pre-employment test that runs unknown packages, scripts or repositories as a warning sign. Before that, the FBI says the actors look for targets on professional networking sites and offer new employment. They then hold long conversations to build rapport.

Binance's account fits this pattern. A Project Director approached the engineer on a job platform. A video call included a shared social media account to build trust. A "CEO" then took over in a chat app and asked the engineer to download an assignment. The turn comes when you are asked to run something.

Is it safe to run a take-home coding test?

Not on a work laptop. The FBI advises avoiding pre-employment tests or running code on company-owned laptops. If a test does need code to run, the FBI says to use a virtual machine on a non-company device, or a device the tester provides. The safe option is a throwaway virtual machine or a hosted environment that holds no credentials.

How did North Korea hack Binance?

The FBI attributed the theft to North Korea's TraderTraitor group on 31 October 2026. Binance says the attack began with a fake job interview, which got an assignment onto an engineer's work computer. From there, the attacker moved through an internal AI tool and used a stolen container deployment token. The attack ended with abuse of a wallet signing service. The interview details come from Binance alone.

What should I do if I ran a suspicious repo?

Disconnect the device from the internet straight away, and leave it powered on. The FBI advises this so that any recoverable malware artifacts stay intact. Tell your security team before you do anything else on that device. Then report the incident to the FBI's Internet Crime Complaint Center. Finally, rotate every credential the machine could reach.

How do I run take-home tests safely as an employer?

Host the exercise in an isolated environment, such as a GitHub codespace or a dev container with an isolated volume. Keep all credentials out of it, and never ask a candidate to run a script or install software. Review the work in a live session on a machine you control. Let candidates confirm your recruiter on a second channel too.

James Hitch, COO at RocketDevs.LinkedIn

Sources

• The Register, Jessica Lyons, North Korean fake job interview led to $6.3B Binance heist, 3 November 2026
• The Register, Carly Page, FBI pins $6.3B Binance crypto heist on North Korean hackers, 2 November 2026
• Binance, 29 October 2026 Binance Security Incident: Initial Findings and Response Update, 3 November 2026
• FBI, North Korea Responsible for $6 Billion+ Binance Attack, 31 October 2026
• TRM Labs, North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History, October 2026
• Elliptic, The largest theft in history: North Korea likely behind the $6.4 billion Binance hack, 30 October 2026
• Chainalysis, Binance Hack: Tracing the $6.4 Billion Theft to North Korea, October 2026
• FBI IC3, North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks, September 2024
• FBI IC3, North Korea Responsible for $1.5 Billion Bybit Hack, February 2025
• FBI, DC3 and Japan's NPA, Identification of North Korean Cyber Actors, Tracked as TraderTraitor, Responsible for Theft of $308 Million from Bitcoin.DMM.com, December 2024
• FBI, CISA and Treasury, AA22-108A, TraderTraitor, 18 April 2022
• U.S. Department of the Treasury, First-Ever Sanctions on a Virtual Currency Mixer, April 2022
• Federal Register, Notice of OFAC Sanctions Actions, 19 April 2022
• Palo Alto Networks Unit 42, Contagious Interview
• Google Threat Intelligence Group, DPRK adopts EtherHiding
• Microsoft Threat Intelligence, Sapphire Sleet and CYBERWARCON, 22 November 2024
• Microsoft Threat Intelligence, Inside the Mastra npm supply chain compromise, 17 June 2026
• SANS Internet Storm Center, Brad Duncan, Malicious Ad for Homebrew Leads to MacSync Stealer, 1 May 2026
• pyenv, README, How It Works
• GitHub, pyenv repository data, read 8 November 2026
• Homebrew, Installation, read 8 November 2026
• npm, scripts and install configuration, read 8 November 2026
• npm, download counts API for Husky, read 8 November 2026
• Husky, Get started, read 8 November 2026
• Microsoft, VS Code Tasks, Workspace Trust and Dev Containers, read 8 November 2026
• Git, githooks documentation, read 8 November 2026
• GitHub, What are codespaces, read 8 November 2026
• Ohm, Plate, Sykosch and Meier, Backstabber's Knife Collection, DIMVA 2020
• Zahan et al., What are Weak Links in the npm Supply Chain?, ICSE-SEIP 2022
• Sejfia and Schaefer, Practical automated detection of malicious npm packages, ICSE 2022
• Hacker News, thread on the Register story, 4 November 2026, read 12 November 2026
• Associated Press, Hyung-jin Kim and Kim Tong-hyung, North Korea denies involvement in Binance hack, criticizes FBI probe, 2 November 2026
• Wikipedia, Lazarus Group, context only