The Binance attack that started with a fake job interview: what coding challenges mean for companies

On 3 November 2026 Binance published an incident report on how the theft of about 6.3 billion US dollars on 29 October was prepared. An engineer who was looking for a new job was approached on a job platform in September by a supposed project director, and in the second interview downloaded an "assignment". Reuters and The Register summarise the report. This post separates what the sources support, what they only claim, and what follows for smaller companies.

Recruiting phishing with a coding challenge is an attack in which criminals invent an employer, stage a hiring process with several interviews, and ask the target to download a programming task and set it up locally. The task contains malicious code that runs during setup or start. It arrives as a repository, not as a mail attachment, and the victim starts it. The machine where this happens decides how bad the damage gets.

What is reported

Binance calls it, in The Register's words, a sophisticated, multi-stage campaign. We could not retrieve the report itself; the account below follows Reuters and The Register, which quote it.

When (2026)	Reported step	Source
June	A wallet-team employee installs a tampered developer tool (Reuters: an AI tool; The Register: a Homebrew install). Binance detects it and replaces the device and the credentials. The employee's role and that of colleagues on the wallet team were known to the attacker.	Reuters, The Register
September	Another engineer is contacted through a "legitimate job-hunting platform" by a supposed project director.	The Register (citing Binance's report)
September, first interview	Video interview with a fake HR person, who shows a social media account with personal photos and videos to build trust.	The Register (citing Binance's report)
September, second interview	A supposed CEO of the invented company hands out an "assignment" for download over a chat app. The code runs on the work computer during setup.	The Register (citing Binance's report), Reuters
After the download	The malware replaces a component of the developer tool pyenv and contacts an attacker-controlled server. Endpoint protection does not flag it right away.	The Register (citing Binance's report)
20 October	Using this machine and an internal AI tool, the attacker takes over two more wallet-team computers. One holds a token for container deployments.	Reuters, The Register
29 October	With that token and the second developer's machine the attacker starts a container and a script that triggers the outflow.	Reuters, The Register
31 October	The FBI names TraderTraitor, a North Korean group.	FBI alert

Everything here comes from the named reports; we reproduced nothing. Some weeks passed between the September download and 20 October. The sources we read do not give the exact infection date, nor the name of the malware family.

Who claims what

The sequence from Binance's report counts as reported where Reuters and The Register agree: fake company, two interviews, download of an assignment, takeover of further machines, outflow on 29 October. They differ on the hardware. The Register writes "work-issued computer", Reuters says only "his computer".

The attribution to North Korea is the FBI's claim. The alert lists wallet addresses to block and gives no evidence for the attribution. TRM Labs and Elliptic had linked North Korea earlier, according to The Register, and according to Reuters North Korea rejects the accusation. The loss figure also varies: Reuters gives 6.3 billion, TRM Labs 6.36 and Elliptic 6.43 billion dollars. That the malware was previously unseen is Binance's statement, which we could not check.

Inferred here is only this: the damage arose because a machine with access to the wallet team ran a hiring-process download. That it was a company device is stated by The Register alone.

Why this is not just an exchange problem

The pattern is older than Binance. Agencies from Australia, Germany, Japan and the US describe it as WaterPlum. Their advisory of 17 September 2026, as The Register reports it, says more than 30,000 devices were infected and more than 7,000 crypto wallets compromised. They attribute at least 10.71 million dollars in thefts to it. Targets are web designers, engineers and Web3 specialists, who are told to download supposed coding assignments. The agencies also warn that an infected machine can later lead into a company network when the person starts a new job.

That applies to any company with developers or administrators who keep tokens, keys or console access on a laptop. At Binance, one token on one machine and one access on a second were enough.

What companies can put in place

The points below are our recommendation derived from the sequence, not statements from the reports and not a description of our own practice.

Code from hiring processes never runs on company devices. Anyone applying elsewhere does so privately.
If a challenge has to be tried, use a throwaway VM from a fresh snapshot: no shared folders, no clipboard to the host, no SSH keys, browser profiles or tokens, discarded after the test. For machines with access to money or production a separate device is safer, because a VM is not an absolute boundary.
The malicious code contacted an attacker's server. Developer and admin machines should reach outward only what they need. The challenge VM gets its own network with no route into the company network and allows only the package sources.
Deployment tokens do not belong permanently on laptops. Short lifetime, storage in a secret store, and a second approval for steps that move money or touch production.
HR and IT agree on a reporting address. Anyone asked to run a program because of a job offer reports it instead of trying it, and is not blamed for it. Otherwise nobody hears about private applications until it is too late. How to anchor this in daily work is covered in Security awareness in SMEs.

More posts on supply chains and hardening are collected in the hub Security and data protection. One line in the IT policy is enough as a first step: code from hiring processes never runs on company devices. Whether your egress rules and token settings fit that can be checked in a review, the offer is on Services.