A Fake Job Interview Started the $6 Billion Binance Hack: How North Korea's Recruiter Scam Works and How to Spot It

The biggest crypto hack in history started with a job interview. Binance says the attackers behind its October 29 breach, now estimated at more than $6 billion, got in through fake job interviews and malicious code, and that their first steps go back to June. The FBI blames North Korea's TraderTraitor unit. Here's how the scam works, and how to make sure it never works on you.

This page has affiliate links: if you buy through them, WIZY may earn a small commission at no extra cost to you. As an Amazon Associate I earn from qualifying purchases.

Published November 4, 2026.

Full timeline of the hack: see our Binance hack coverage and the 2026 crypto hacks tracker.

Related: Binance Hack Hits $6.3 Billion, the Biggest Ever; Analysts Link It to North Korea · Crypto Hacks 2026 Tracker: Binance, Mercado Bitcoin, Polymarket and Every Major Breach

What Binance revealed

Earlier reports said Binance's preliminary investigation pointed to a compromised engineer's laptop. The new details explain how that laptop was compromised: not through a clever technical exploit, but by tricking a person.

How a fake job interview turns into a hack

North Korean groups have used fake recruiting for years, and security researchers describe the same pattern again and again:

1. The approach: a friendly "recruiter" reaches out on LinkedIn, Telegram or email with a well-paid job at a crypto company. The profile looks real, often with a stolen name and photo.
2. The interview: there are real-looking conversations, sometimes several rounds, to build trust.
3. The "test": the candidate is asked to download a coding assignment, run a project from a code repository, or install a "special" video-call app for the next interview.
4. The trap: that file is malware. Once it runs, the attackers can watch the computer, steal passwords and session keys, and quietly wait.
5. The heist: months later, with enough access, they strike all at once. At Binance, the theft itself took about four hours, after roughly four months of preparation.

The FBI has tied the same TraderTraitor group to earlier record thefts, including the $1.5 billion Bybit hack in 2025. The method keeps working because it targets people, not code.

Red flags: how to spot a fake recruiter

• They want you to install something. A real company doesn't need you to run their code or a custom meeting app on your own computer to interview you. Use Zoom, Google Meet or Teams from the official sites.
• The offer is too good. A huge salary for little experience, or "urgent" hiring with no clear process.
• The contact moves off-platform fast, to Telegram, WhatsApp or a personal email.
• The coding test comes as a zip file or an unknown repository, especially one that asks you to run install scripts.
• Small details don't match: a new profile, few connections, a company website that looks thin, or an email domain that isn't the company's.

Like this kind of news? Get the WIZY weekly: one email every Sunday, no spam.

How to protect yourself

• Never run job "tests" on the computer you use for crypto. If you must, use a separate machine or a virtual machine with nothing important on it.
• Verify the recruiter through the company's official website or careers page, not the link they send you.
• Keep long-term crypto off exchanges and off your everyday computer. A hardware wallet keeps your keys offline, so malware on your laptop can't sign transactions without you pressing the button.
• Turn on app-based two-factor authentication (not SMS) and withdrawal address allow-lists on every exchange.
• Never share your seed phrase. No recruiter, support agent or exchange will ever need it.

What it means for Binance users

If you hold funds on Binance, the company says losses are covered and withdrawals are working again, starting with Bitcoin, Ethereum and Solana on November 1. The bigger lesson is for everyone: even the world's largest exchange was breached through one person's computer. The safest crypto is crypto that only you control.