I read Binance’s report on the hack twice. I skimmed over the $6.3 billion figure, but what made me stop was how Engineer B got caught.
He was approached by a “project director” on a legitimate job-hunting platform. The first round was a live video interview with an actual HR person. They even showed him their social media account, which was full of everyday photos.
For the second round, they switched to a messaging app. Near the end, they asked him to download an “assignment” onto his work computer. The code ran during installation, secretly replacing a legitimate development tool on his computer with a malicious version. His antivirus didn’t detect it.
Another engineer, A, had been caught even earlier, in June. He wanted to install an AI coding tool, searched for the installer on a search engine, and downloaded a tampered Homebrew installer. The security team detected the replacement on that computer, but his and his colleagues’ job information had already leaked to the attackers. My guess is that this is how B was targeted.
On October 20, the hackers used B’s computer as a stepping stone, leveraging an internal AI tool to get into the computers of A and another engineer, C. In the early hours of October 30, they used A’s credentials to work their way to the wallet signing process.
My first thought after reading this was: people in crypto run into this stuff every day. It’s just dressed up differently.
In crypto, interviews become “project collaborations,” “beta invites,” or “ambassador recruitment.” The playbook is exactly the same: build rapport first, then ask you to download a beta, run a script, or install a specific video conferencing app.
I’ve had messages like this in my own DMs: [Screenshot of suspicious DM + what they asked you to install]
Binance itself says it blocked 57 suspected North Korean attacks this year. The methods included fake interviews, malware disguised as development tools, tampered browser extensions, and fake video conferencing software.
They blocked 57 attacks. One that slips through costs $6.3 billion.
So after reading the report, I checked my own computer too: [What you checked, how you checked, and what you found]
Cosine said not to just laugh at these engineers for being so careless—you only realize how many tricks there are after you’ve been hit yourself. I agree. An entire Binance security team got caught out, so those of us on our own should be even more careful.
I stick to three rules:
1. Anything someone asks me to download, install, or run stays off the computer and phone I use to manage my funds.
2. I only access wallets, extensions, and development tools through their official websites. I type in the addresses myself or use bookmarks I saved earlier. I never click search results.
3. If an “interview” or “collaboration” leads to someone asking me to install software, run code, or share my screen, I end the conversation immediately.
The device I use to manage funds is only for managing funds. Yang Haipo of ViaBTC criticized Binance, and his first point was that coding, chatting, and browsing weren’t separated from the production environment. For us as individuals, that means using one device for chatting and downloads, and another for signing and transferring. An old phone will do.
Also, a live video call and an account full of everyday photos prove nothing. That’s exactly how B got caught. Don’t judge whether someone is genuine by how they look; judge them by what they ask you to do. If they want you to install something on your own computer, end the conversation.
If you’ve received a similar DM recently, post a screenshot in the comments—with identifying details blurred—and I’ll take a look with you.
#StaySafe
#避坑提醒 #crypto #meme #BSC
He was approached by a “project director” on a legitimate job-hunting platform. The first round was a live video interview with an actual HR person. They even showed him their social media account, which was full of everyday photos.
For the second round, they switched to a messaging app. Near the end, they asked him to download an “assignment” onto his work computer. The code ran during installation, secretly replacing a legitimate development tool on his computer with a malicious version. His antivirus didn’t detect it.
Another engineer, A, had been caught even earlier, in June. He wanted to install an AI coding tool, searched for the installer on a search engine, and downloaded a tampered Homebrew installer. The security team detected the replacement on that computer, but his and his colleagues’ job information had already leaked to the attackers. My guess is that this is how B was targeted.
On October 20, the hackers used B’s computer as a stepping stone, leveraging an internal AI tool to get into the computers of A and another engineer, C. In the early hours of October 30, they used A’s credentials to work their way to the wallet signing process.
My first thought after reading this was: people in crypto run into this stuff every day. It’s just dressed up differently.
In crypto, interviews become “project collaborations,” “beta invites,” or “ambassador recruitment.” The playbook is exactly the same: build rapport first, then ask you to download a beta, run a script, or install a specific video conferencing app.
I’ve had messages like this in my own DMs: [Screenshot of suspicious DM + what they asked you to install]
Binance itself says it blocked 57 suspected North Korean attacks this year. The methods included fake interviews, malware disguised as development tools, tampered browser extensions, and fake video conferencing software.
They blocked 57 attacks. One that slips through costs $6.3 billion.
So after reading the report, I checked my own computer too: [What you checked, how you checked, and what you found]
Cosine said not to just laugh at these engineers for being so careless—you only realize how many tricks there are after you’ve been hit yourself. I agree. An entire Binance security team got caught out, so those of us on our own should be even more careful.
I stick to three rules:
1. Anything someone asks me to download, install, or run stays off the computer and phone I use to manage my funds.
2. I only access wallets, extensions, and development tools through their official websites. I type in the addresses myself or use bookmarks I saved earlier. I never click search results.
3. If an “interview” or “collaboration” leads to someone asking me to install software, run code, or share my screen, I end the conversation immediately.
The device I use to manage funds is only for managing funds. Yang Haipo of ViaBTC criticized Binance, and his first point was that coding, chatting, and browsing weren’t separated from the production environment. For us as individuals, that means using one device for chatting and downloads, and another for signing and transferring. An old phone will do.
Also, a live video call and an account full of everyday photos prove nothing. That’s exactly how B got caught. Don’t judge whether someone is genuine by how they look; judge them by what they ask you to do. If they want you to install something on your own computer, end the conversation.
If you’ve received a similar DM recently, post a screenshot in the comments—with identifying details blurred—and I’ll take a look with you.
#StaySafe
#避坑提醒 #crypto #meme #BSC
