A fake job interview hack is a social engineering attack in which someone poses as a recruiter or hiring manager and persuades a developer to run a malware-laced coding assignment. According to the incident report Binance published on November 3, 2026, that is one of the ways North Korea-linked attackers got a foothold before draining about $6.3 billion from the exchange on October 29. This guide uses what Binance, security researchers and news outlets had published as of early November 2026 to explain how the scheme works, how to vet a take-home test before running it and what to do if you already did. The investigation is ongoing, so details may change.

How a fake job interview hack reached Binance's wallets

Binance described the breach as a multi-stage campaign rather than a single phishing email, as The Register's summary of the report explains. The FBI attributed the theft to TraderTraitor, a North Korean operation linked to the Lazarus Group. The interview was the pivotal step, but it was not the first one.

1. 1

   June: a tampered installer

   A wallet infrastructure engineer looking for an AI coding tool downloaded a tampered Homebrew installation. Security staff caught it, replaced the device and rotated credentials, but Binance says the engineer's role and his wallet-team colleagues had already been exposed.

2. 2

   September: two rounds of fake interviews

   Another software engineer was approached on a legitimate job-hunting platform by someone posing as a project director. The first round was a live video call with a fake HR representative who shared a social media account with personal photos and videos. The second, with a purported CEO, took place on a popular chat app and ended with instructions to download an assignment.

3. 3

   Setup runs the malware

   The code executed on the engineer's work computer during setup. It swapped a legitimate developer-tool component for a malicious one, contacted an attacker server and was not immediately caught by endpoint security.

4. 4

   October 20 and 29: lateral movement and theft

   Using the infected machine and an internal AI tool, the attackers took over two wallet engineers' computers and found a container deployment token. On October 29 they used it to deploy a container and run the script that moved the funds.

CoinDesk reports that funds began leaving at 20:05 UTC and that the attacker used Ethereum's EIP-7702 feature to gain execution rights over a hot wallet. Binance said about $2.85 billion had been frozen, that it had replenished about 98% of the affected tokens with company funds and that it had blocked 57 suspected North Korea-linked attempts this year. Totals differ by source; Chainalysis puts the theft at $6.4 billion.

The North Korean recruiting scam playbook

Microsoft calls the broader operation the Contagious Interview campaign and says it has been active since at least December 2022. Attackers typically pose as recruiters for crypto trading firms or AI companies and ask candidates to clone and run a project hosted on GitHub, GitLab or Bitbucket. In recent cases, opening the project in Visual Studio Code and choosing to trust the author was enough to run the repo's task configuration, which fetched the backdoor.

Once inside, malware families Microsoft documents, such as OtterCookie, BeaverTail and InvisibleFerret, hunt for environment files, wallet recovery phrases, KeePass and 1Password artifacts and clipboard contents, then upload them. Some variants show a fake technical error on a bogus interview site and tell the candidate to paste a command to fix it. Developer machines are attractive because they often hold source code access, CI/CD credentials and cloud keys.

Individual holders are targets too

Chainalysis says it has attributed more than $14.3 million in losses over the past 18 months to similar DPRK-linked fake interview and malware schemes, hitting individual holders, private wallets, protocols and DAOs as well as companies. Some victims lost private keys kept in cloud storage even though the seed phrase was never downloaded to the infected device, which suggests access through cloud credentials or browser sessions.

How to vet a malicious coding test before you run it

The single most important decision is where you open the assignment. Microsoft recommends a dedicated, non-persistent virtual machine rather than a corporate workstation with production credentials, internal repositories or privileged cloud sessions. The same logic applies to a personal laptop that has wallet apps or exchange accounts signed in.

1. Confirm the role and interviewer through the company's official website, not through links the recruiter supplies.
2. Check when the repository and the author's account were created and how much history they have. A days-old repo from a days-old account is a warning sign.
3. Read install-related scripts in package.json (such as preinstall and postinstall), any editor task folders like .vscode, and setup shell scripts as plain text before running them.
4. Stop if you see download-and-execute patterns, URL shorteners or long obfuscated strings.
5. Keep Visual Studio Code in Restricted Mode for unfamiliar projects and do not grant trust to an unknown author.
6. Decline any request to paste a terminal command to fix an error or to turn off security software; it is not part of a legitimate test.

Already ran it? What to do next

Do not change passwords on the suspect machine, because new credentials typed there may be captured too. Microsoft's guidance is to isolate the device, rotate credentials and tokens that may have been exposed and review recent access to code repositories and CI/CD systems.

1. 1

   Disconnect

   Take the device off Wi-Fi and wired networks. If it is a work machine, alert your security team right away and do not wipe it yourself.

2. 2

   Reset from a clean device

   From another device, change passwords for email, code hosting, cloud and exchange accounts and sign out all sessions. Revoke API keys and access tokens and issue new ones.

3. 3

   Move wallet funds if needed

   If a seed phrase or private key ever lived on that machine, in cloud notes or in a password manager, create a new wallet on a clean device and consider moving funds. Review token approvals on the old address.

4. 4

   Preserve evidence and report

   Save the recruiter profile, chat logs and assignment links. In the US you can report to the FBI's Internet Crime Complaint Center; elsewhere, contact your national cybercrime authority.

What exchange users should watch

This incident shows that one employee's job search can become a path into an exchange's wallets. Binance says it has rebuilt the affected wallet system and internal AI tool, replaced compromised devices and decommissioned the engineers' credentials and tokens. After a major exchange incident, deposit and withdrawal conditions can change quickly, so check official notices before moving funds.

Theddari's Telegram crypto trends page shows how security news such as hacks or paused withdrawals spreads across channels; treat those posts as leads and confirm them against the exchange's own announcements. The Kimchi premium page compares prices on Korean and global exchanges and can help you see whether gaps widen while transfers are restricted. A visible gap does not mean you can move funds or arbitrage it; deposit status and fees come first.

Page Reference

Trendstheddari.com›TrendsTelegram · CryptoLive posts from crypto channels

Page Reference

Cryptotheddari.com›CryptoKimchi PremiumLive price gap between Korean and global exchanges

In short, verify every job offer through official channels, open take-home tests only in an isolated environment with no keys or privileged sessions, read the scripts before running them and, if something looks wrong afterward, clean up accounts and wallets from a separate device. If you work in crypto, remember that a public profile describing wallet or security duties in detail can itself help attackers pick their next target.