Binance says it has detected and blocked 57 suspected cyber incidents linked to North Korea since the start of 2026, including fake job interviews and tampered software packages. In September, a project director claiming to work for a nonexistent company contacted a software engineer through a legitimate recruitment platform. The attacker first gained the engineer’s trust, then asked them to download an infected code repository during a second-round interview. In June, another engineer downloaded a tampered Homebrew installer, prompting Binance’s security team to replace devices and change all credentials.