Binance security chief warned of job interview hack months before $6.3bn theft
Chief security officer Jimmy Su described the specific malware tactic used against an employee in September as a primary internal concern during a July interview.
Key takeaways
- 1Binance lost $6.3bn in an October hack, the largest in cryptocurrency history.
- 2A software engineer downloaded malware during a fake job interview in September.
- 3Chief security officer Jimmy Su warned of this specific tactic in a July interview.
- 4The exchange has blocked 57 threats linked to North Korea so far this year.
- 5Binance has since rebuilt wallet systems and tightened device controls.
Binance chief security officer Jimmy Su warned that fake job interviews could be used to compromise the exchange months before a $6.3bn hack used that exact method. Su said in a July interview that attackers often target employees with tailored job opportunities to persuade them to run malicious code during technical assessments. Once executed, the code allows attackers to compromise devices and harvest credentials to penetrate internal networks.
The warning preceded the largest theft in the history of the cryptocurrency industry, which occurred in October. A preliminary investigation by Binance found that a software engineer downloaded a malicious coding assignment onto a work computer during a fake job interview in September. This breach became a key stage in the multi-stage attack that led to the theft of funds.
Su said in July that these attacks are difficult to detect because the individual steps often appear legitimate. An applicant might be asked to download a code repository from a platform like GitHub, which is a standard practice in software development. Because the actions mimic normal work, many anti-virus and security tools fail to flag the execution of the hidden malware.
The exchange confirmed that the malware used in the September breach successfully evaded its endpoint security tools through obfuscation and other evasion techniques. Su said it is the responsibility of the company to contain the risk when employees pursue outside opportunities on work devices. He added that Binance had been running monthly phishing simulations for several years to improve security hygiene.
Binance said it has blocked 57 cyber threats linked to North Korea so far this year, which averages one attack every five days. Following the October theft, the company rebuilt its wallet systems and internal artificial intelligence tools. It also strengthened access controls and revoked credentials that were compromised during the attack.
Recruiters in the industry said the incident has changed how some firms assess candidates. Kevin Gibson of recruitment firm Proof of Search said some clients now require confirmation that a candidate has been met in person by a recruiter before proceeding. He said a fake job offer or a brief introductory call can serve as the first step in a multimillion-dollar theft.
Reported and edited by the YourKhabri desk under our editorial policy. Nothing here is investment advice.