The entry point for the $6.34 billion theft wasn’t some earth-shattering zero-day—it was a fake job interview.
Binance CSO Jimmy Su revealed that an engineer was approached by a “project lead” on a legitimate recruiting platform. A fake HR rep conducted a video interview, a fake CEO showed up on camera, and then they sent over a malicious-code repo as a “test assignment.” Install it on your work computer, and the door to a $6.34 billion theft swings open.
One takeaway: hackers don’t break down walls; they target people. Recruiting platforms are hunting grounds too, and that “coding test” a recruiter sends you could be a payload. If you write code, don’t pull unfamiliar repos onto your work machine.
CZ also shared another case today: someone got compromised by WhatsApp auto-downloading a file. The hacker lay low for five days, watching his tweets about short positions, then waited for the market to hit 68k, closed the position in one go, and moved the funds through Tornado Cash.
The first domino was tipped over by an “interview” a few months ago. Check your on-chain approvals, and stay extra vigilant during job-hunting season.
NFA DYOR
$BTC $BNB
#币安 #安全事件 #社工攻击 #比特币 #Cryptocurrency
Binance CSO Jimmy Su revealed that an engineer was approached by a “project lead” on a legitimate recruiting platform. A fake HR rep conducted a video interview, a fake CEO showed up on camera, and then they sent over a malicious-code repo as a “test assignment.” Install it on your work computer, and the door to a $6.34 billion theft swings open.
One takeaway: hackers don’t break down walls; they target people. Recruiting platforms are hunting grounds too, and that “coding test” a recruiter sends you could be a payload. If you write code, don’t pull unfamiliar repos onto your work machine.
CZ also shared another case today: someone got compromised by WhatsApp auto-downloading a file. The hacker lay low for five days, watching his tweets about short positions, then waited for the market to hit 68k, closed the position in one go, and moved the funds through Tornado Cash.
The first domino was tipped over by an “interview” a few months ago. Check your on-chain approvals, and stay extra vigilant during job-hunting season.
NFA DYOR
$BTC $BNB
#币安 #安全事件 #社工攻击 #比特币 #Cryptocurrency