Months before Binance lost $6.3 billion in what became the biggest crypto exchange hack in history, the company's chief security officer described, in an interview with Cointelegraph, exactly how a fake job interview could hand attackers a foothold inside the exchange. The tactic he outlined closely resembles one of the entry methods later used against the platform. The episode illustrates how an exchange's hiring process can serve as an attack surface in its own right, alongside the code and infrastructure that security teams conventionally defend.

During a July interview about Binance's response to rising security threats, chief security officer Jimmy Su said fake job interviews were "something we worry about a lot internally." He explained that attackers could tailor a job opportunity to a specific employee and then persuade them to run code as part of a technical assessment.

"And once that gets executed, the device is compromised and then they can start harvesting credentials," Su said, adding that attackers could then use that access to penetrate further into the network.

Su's detailed warning about malicious coding assessments was not included in Cointelegraph's July coverage, but it has taken on new significance following October's theft. According to Binance's preliminary investigation, a Binance software engineer downloaded a malicious coding assignment onto his work computer during a fake job interview in September. That compromise became part of a multistage attack that culminated in the October breach.

Su had also anticipated why security tools might miss such a trap. A technical assessment could involve seemingly legitimate steps, such as downloading a code repository from GitHub, he explained in July.

"Each step is actually legitimate on its own. So a lot of the anti-virus tools may not be able to detect it and flag it," he said.

Binance's investigation subsequently described a similar detection failure, saying the assignment's setup process executed malware that evaded the exchange's endpoint security tools through obfuscation and other evasion techniques.

Binance said the onus is on the company to detect attacks

Su told Cointelegraph that containing the risk of employees pursuing outside opportunities on work computers was Binance's responsibility.

"Of course employees can explore outside opportunities. What we do worry about is that they do so on the company device," he said. If an employee fell for a fake interview, he added, "the onus is on us to detect it" and to "stop the actual execution of that code."

Related: North Korean hackers create memecoins to launder funds from the Binance hack, according to blockchain analytics firm Elliptic.

Binance had already been testing its employees against fake recruiters. Su said the company's internal red team had been running monthly phishing simulations for three to four years, with remedial training for employees who failed.

"In the beginning, the security hygiene left a lot to be desired. But after this amount of time, the company has improved significantly," he said.

The September compromise occurred despite that multiyear simulation program, a reminder that awareness training alone does not close off approaches tailored to a specific employee — the exact method Su described in July.

The threat is also changing how some crypto employers assess prospective hires, according to Kevin Gibson of recruitment firm Proof of Search, who told Cointelegraph that clients increasingly want to know whether candidates have been met in person.

"A number of our clients are now asking us straight up whether we've met a candidate in person," Gibson said, adding that candidates personally met by a third-party recruiter have an advantage.

Employees, as in Binance's case, can also become targets. "In crypto, a dodgy job offer or a 'quick catch-up call' can be the first step in a multimillion-dollar hit," he said.

For businesses holding customer funds, that means the recruiting channel effectively becomes part of the security perimeter: a single compromised work device can open a path toward deeper internal systems, as Binance's own account of the breach describes.

Binance blocks a North Korean cyber threat every five days

Binance said it has blocked 57 suspected North Korea-linked cyber threats so far this year, which is roughly one attack every five days.

That pace, together with Elliptic's report on memecoin-based laundering of the stolen funds, points to sustained North Korea-linked activity targeting the exchange rather than an isolated incident.

Following October's attack, Binance said it had tightened device controls, rebuilt affected wallet systems and internal AI tooling, strengthened access controls, and revoked compromised credentials. The exchange also said it was increasing investment in endpoint protection and developer-environment security and had engaged independent cybersecurity experts to review the incident. Some technical details and security measures would remain confidential, it said.

With Binance's findings still preliminary and some technical details withheld, further updates from the investigation and the independent experts' review are the developments to watch for a fuller account of how the attackers moved through the exchange's systems and what additional protections follow.