Fake Job Interview Used to Breach Binance Engineers in Record Crypto Heist

Crypto exchange Binance has revealed that a months-long campaign against its software engineers led to a record-breaking digital heist last week. In a post on X on November 3, the company said it was "not a single isolated breach or a simple phishing incident". Instead, the attackers combined fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise and an advanced transaction-authorisation method.

According to Binance, the main point of entry was a fake interview set up in September with an engineer it calls "Software Engineer B". Someone posing as a project director approached the engineer through a legitimate job-hunting platform, having spotted from their profile that they worked at Binance. A fictitious HR representative ran the first round and shared a social media account with personal photos and videos to build trust. In the second interview, held on a popular chat app, the engineer was told to download an "assignment" onto a work computer. It contained a malicious code repository that ran during setup. Binance says the malware was previously unknown and used evasion techniques to avoid the engineer's endpoint security tools.

On October 20, the attacker used the engineer's computer to reach an internal AI tool and compromise the machines of two more employees. One of them, a wallet DevOps engineer, had been targeted back in June after clicking a malicious search ad and downloading a malicious version of the Homebrew package manager for macOS. This summary is based on the opening of the article only, so further details are not covered here.