#Binance 'S $6.34 BILLION #Hack : HOW FAKE JOB INTERVIEWS BECAME A CYBER WEAPON
Sometimes, a cyberattack doesn't begin with a vulnerability in a computer system. It begins with a friendly message offering you a better job.
In one of the largest cryptocurrency thefts ever reported, Binance has revealed details of a sophisticated attack involving approximately $6.34 billion in stolen assets, attributed by the FBI to North Korean hackers.
But the most surprising part is how it all started.
According to Binance's investigation, an individual posing as a project manager contacted one of the company's engineers on LinkedIn.
Two fake job interviews followed. One involved someone pretending to be an HR representative, while the other featured an individual claiming to be the CEO of a non-existent company.
The engineer was eventually asked to download a technical assessment file as part of the recruitment process.
The file contained malicious code that allowed attackers to compromise the engineer's device.
And that was only one part of the operation.
In June, another engineer had downloaded a compromised version of Homebrew after encountering it through an online advertisement. The attackers used this access to gather information about employees responsible for wallet infrastructure.
The operation later escalated, with compromised devices and internal AI tools helping attackers gain access to additional systems before unauthorized transfers were carried out on October 29–30.
What happened to the stolen funds?
According to Binance's November 3 update:
Estimated stolen assets: $6.34 billion.
Assets frozen or blocked: approximately $2.85 billion.
Binance reports that it has replenished 98% of the affected assets using its own resources.
The bigger lesson goes beyond cryptocurrency.
Social engineering is evolving. Hackers are no longer relying exclusively on technical vulnerabilities. They are exploiting trust, professional ambition and ordinary recruitment procedures.
A seemingly legitimate job opportunity can become a major security incident
Sometimes, a cyberattack doesn't begin with a vulnerability in a computer system. It begins with a friendly message offering you a better job.
In one of the largest cryptocurrency thefts ever reported, Binance has revealed details of a sophisticated attack involving approximately $6.34 billion in stolen assets, attributed by the FBI to North Korean hackers.
But the most surprising part is how it all started.
According to Binance's investigation, an individual posing as a project manager contacted one of the company's engineers on LinkedIn.
Two fake job interviews followed. One involved someone pretending to be an HR representative, while the other featured an individual claiming to be the CEO of a non-existent company.
The engineer was eventually asked to download a technical assessment file as part of the recruitment process.
The file contained malicious code that allowed attackers to compromise the engineer's device.
And that was only one part of the operation.
In June, another engineer had downloaded a compromised version of Homebrew after encountering it through an online advertisement. The attackers used this access to gather information about employees responsible for wallet infrastructure.
The operation later escalated, with compromised devices and internal AI tools helping attackers gain access to additional systems before unauthorized transfers were carried out on October 29–30.
What happened to the stolen funds?
According to Binance's November 3 update:
Estimated stolen assets: $6.34 billion.
Assets frozen or blocked: approximately $2.85 billion.
Binance reports that it has replenished 98% of the affected assets using its own resources.
The bigger lesson goes beyond cryptocurrency.
Social engineering is evolving. Hackers are no longer relying exclusively on technical vulnerabilities. They are exploiting trust, professional ambition and ordinary recruitment procedures.
A seemingly legitimate job opportunity can become a major security incident
