Search

Kevin

when

Months before Binance lost $6.3 billion to a hack, its chief security officer described to Cointelegraph how a fake job interview could give attackers a foothold inside the exchange — closely resembling one of the entry methods later used against the exchange.
During a July interview about Binance’s response to rising security threats, Jimmy Su told Cointelegraph that fake job interviews were “something we worry about a lot internally,” explaining how attackers could tailor a job opportunity to an employee before persuading them to run code as part of a technical assessment.&nbsp;
“And once that gets executed, the device is compromised and then they can start harvesting credentials,” Su said, adding that attackers could then use that to <a href="https://ct.com/news/binance-hackers-8-weeks-access-63b-exploit-security-alliance" rel="noopener noreferrer nofollow">penetrate further into the network</a>.
Su’s detailed warning about malicious coding assessments was not included in <a href="https://ct.com/news/binance-red-teams-own-staff-every-month-to-keep-hackers-out" rel="noopener noreferrer nofollow">Cointelegraph’s July coverage</a>, but takes on new significance following the biggest crypto exchange hack in history.
In September, a Binance software engineer downloaded a malicious coding assignment onto his work computer during a fake job interview. That compromise became part of the multistage attack that culminated in October’s theft, <a href="https://www.binance.com/en-AU/blog/community/3229153443759566763" rel="noopener noreferrer nofollow">according</a> to Binance’s preliminary investigation.
During the interview with Cointelegraph, Su had also anticipated why security tools might miss such a trap. A technical assessment could involve seemingly legitimate steps, such as downloading a code repository from GitHub, he explained in July.
“Each step is actually legitimate on its own. So a lot of the anti-virus tools may not be able to detect it and flag it,” he said.
Binance’s investigation subsequently described a similar detection failure, saying the assignment’s setup process executed malware that evaded its endpoint security tools through obfuscation and other evasion techniques.
<h2 id="binance-said-onus-is-on-the-company-to-detect-attacks">Binance said onus is on the company to detect attacks</h2>
Su told Cointelegraph that it was Binance’s responsibility to contain the risk when employees pursued outside opportunities on work computers.
“Of course employees can explore outside opportunities. What we do worry about is that they do so on the company device,” he said. If an employee fell for a fake interview, he added, “the onus is on us to detect it,” and to “stop the actual execution of that code.”
Related: <a href="https://ct.com/news/north-korean-hackers-memecoins-launder-binance-hack-elliptic" rel="noopener noreferrer nofollow">North Korean hackers create memecoins to launder funds from Binance hack: Elliptic</a>
Binance was <a href="https://ct.com/news/binance-red-teams-own-staff-every-month-to-keep-hackers-out" rel="noopener noreferrer nofollow">already testing employees</a> against fake recruiters. Su said its internal red team had been conducting monthly phishing simulations for three to four years, with remedial training for employees who failed.
“In the beginning, the security hygiene left a lot to be desired. But after this amount of time, the company has improved significantly,” he said.
Kevin Gibson of recruitment firm Proof of Search told Cointelegraph that the threat is also changing how some crypto employers assess prospective hires, with clients increasingly wanting to know whether candidates have been met in person.
“A number of our clients are now asking us straight up whether we’ve met a candidate in person,” Gibson said, adding that candidates personally met by a third-party recruiter have an advantage.
Employees, like in Binance’s case, can also become targets.
“In crypto, a dodgy job offer or a ‘quick catch-up call’ can be the first step in a multimillion-dollar hit,” he said.
<h2 id="binance-blocks-a-north-korean-cyber-threat-every-five-days">Binance blocks a North Korean cyber threat every five days</h2>
Binance said it blocked 57 suspected North Korea-linked cyber threats so far this year, which is roughly one attack every five days.&nbsp;
Following October’s attack, Binance said it had tightened device controls, rebuilt affected wallet systems and internal AI tooling, strengthened access controls and revoked compromised credentials.
It also said it was increasing investment in endpoint protection and developer-environment security, and engaging independent cybersecurity experts to review the incident. Some technical details and security measures would remain confidential, it said.
Magazine: <a href="https://ct.com/magazine/bitcoins-best-buying-opportunity-ever-has-arrived-mark-moss" rel="noopener noreferrer nofollow">Bitcoin’s ‘best buying opportunity ever’ has arrived: Mark Moss</a>

Binance CSO unwittingly foreshadowed $6.3B hack tactic months before attack

Table of Contents

Cointelegraph

Other articles published on Nov 12, 2026

Join our free newsletter for daily crypto updates!