Binance says it blocked multiple cyberattacks attributed to North Korean threat actors over the past week, and that none of the attempts compromised its systems or resulted in lost assets.

The attackers did not attempt brute-force intrusion. They posed as prospective employers.

According to the exchange, the campaign is tied to a social engineering operation known as "Contagious Interview," in which fake hiring processes are used to trick targets into running malicious software on their own machines.

How the Attack Works, and How Binance Stopped It

Binance disclosed the incidents on October 27, 2026, stating that the blocked attempts had taken place over the previous week.

The Contagious Interview playbook relies on deception. Targets are approached with what appears to be a legitimate job opening, then guided through interviews and coding assessments. At some point, the candidate is nudged into executing code that turns out to be malicious.

The coding test is the central element of the scheme. Developers run unfamiliar code as a matter of routine, so a request to download a project and execute it can feel entirely normal. That familiarity is the bait.

The choice of vector is part of what makes this disclosure notable for the wider industry. Rather than probing perimeter infrastructure, the campaign treats people as the entry point—an approach where technical controls alone have limits, and where hiring practices and endpoint habits sit alongside firewalls and monitoring on the defensive agenda.

Binance reported that no systems were compromised and no assets were lost. The exchange urged both users and its own staff to remain alert to unauthorized software and unverified code, framing employee awareness and internal security monitoring as core defenses.

A Crowded Threat Landscape

The disclosure lands as concerns grow over North Korea's cyber activity aimed at the crypto sector. Recent reports have pointed to incidents involving suspected North Korean groups, including the Lazarus Group and SquidSquad, across a range of exploits and fund thefts.

One recent example hit close to home for Binance. On October 8, 2026, a $2.84 million drain from the BNB Chain was attributed to SquidSquad.

That incident and this week's blocked attempts are separate events. One reportedly succeeded in taking funds from a network, while the other, according to Binance, failed to get past the exchange's defenses.

Taken together, the two episodes sketch the range of North Korea-linked activity the sector is watching: on-chain exploits aimed at funds on one side, and social engineering aimed at people on the other.

What This Means for Exchanges and Their Users

For Binance, the outcome is a defensive win it can point to. Stopping a coordinated campaign without losses suggests its layered security approach—combining technical controls with continuous monitoring and threat detection—did its job this time.

The disclosure also has value in its own right. By naming the playbook in use, it gives other companies and job seekers a concrete pattern to screen against.

For individual users, the exchange's guidance is straightforward and worth repeating. Treat unsolicited job offers with suspicion, especially those that involve downloading and running code. Avoid unauthorized software. Verify before you execute.

Job seekers in crypto face a particularly awkward dilemma. The industry hires heavily through remote, informal channels, and technical tests are a standard part of the process. That makes it difficult to tell a genuine opportunity from a carefully staged trap—which is exactly what the attackers are counting on.