The Binance Hack Started With a Fake Job Interview on a Work Laptop: $6.34 Billion, and 6 Rules for Your Company's Devices

If your staff look for jobs or try new software on their work computers, that is exactly the path behind the largest theft in crypto history. On November 3, 2026, Binance published its preliminary findings: the attack that hit about $6.34 billion on October 29 began with two fake job interviews for an engineer, ending with a coding test he downloaded onto his work laptop. The practical takeaway for your company: no files from outside recruiters on work devices, no software outside an approved list, and no permissions wider than the job needs. On October 31 we wrote about who can move your company's money without your sign-off; this article is about the door the attacker came in through.

What happened, step by step?

According to Binance's account of its preliminary investigation, the attack went through four stages:

• June 2026: A wallet-team engineer searching for an AI coding tool downloaded a tampered Homebrew installer carrying malware. The security team caught it, replaced the device and rotated his credentials, but information about him and his teammates had already leaked.
• September 2026: Someone posing as a project director approached a second engineer through a job platform and ran two interviews: a video call with a supposed HR representative, then one with a person claiming to be the CEO of a fictitious company. In the second interview he was told to download a coding assignment onto his work computer; the malicious code ran during setup and endpoint tools did not catch it.
• October 20, 2026: The attacker used the compromised computer and an internal Binance AI tool to take control of two other engineers' machines.
• October 29, 2026: Between 17:15 and 19:56 UTC the attacker accessed the third engineer's computer with credentials stolen from the first, deployed a container and triggered a malicious script; hot wallet transfers followed between 20:05 and 20:09.

Binance says about $2.85 billion was frozen or intercepted, that it had replenished 98% of the affected assets by October 31, and that it detected and stopped 57 suspected North Korea-linked threat cases during 2026. In other words, the exchange fended off dozens of attempts, then fell to one.

Why did the fake interview work?

Because it looks nothing like a phishing email. The employee did not click a suspicious link from an unknown sender; he entered a hiring process that felt real: a known platform, a video interview, an HR representative who shared content from her personal account to build trust, then a CEO. Downloading and running a project is a normal part of developer tests, so the request did not stand out.

The tactic is not new. TechCrunch notes that a CrowdStrike report attributed about half of intrusions at U.S. tech companies last year to North Koreans posing as remote IT workers or recruiters. The target is not just crypto exchanges, but anyone with access to systems or money.

The second gap: software downloaded from search results

The story did not begin with the interview. Three months earlier another engineer installed tampered software while looking for an AI tool. This happens in many companies every day: an employee hears about a new tool, searches for it, clicks the first result and installs it with admin rights. The bigger lesson is that Binance replaced the device and changed the passwords, yet the information already leaked about the team stayed with the attacker and was used months later.

6 rules for your staff's devices this week

• No outside recruiting files on work devices: any test, project or file sent by an outside party is opened on a separate machine with no access to company systems. That matches the expert advice quoted by TechTarget: keep interview code off any machine near production.
• Software from an approved list only: remove local admin rights from staff, and route installs through your IT lead from the vendor's official site, not from an ad in search results.
• Least privilege: whoever can move money or change sensitive systems does it from a dedicated account and device, not from the machine they browse on and test tools with.
• Tight permissions for internal AI tools: at Binance an internal AI tool was the bridge between devices. Any tool that reaches staff devices or your systems needs narrow permissions and a log of everything it does.
• Detection is not the end of an incident: if a device is compromised, do not just replace it. Assume what was on it has leaked, rotate every password, key and token tied to it and to its team, and watch colleagues' accounts.
• Train your team on job-offer phishing: an attractive offer that asks to download a file or run code is a red flag, and job hunting from a work device exposes the whole company. If you hire remotely, verify a candidate's identity before granting any access.

What do the Essential Cybersecurity Controls say?

The National Cybersecurity Authority's Essential Cybersecurity Controls ECC-2:2024 are mandatory for government agencies and for entities that own, operate or host Critical National Infrastructure, and the NCA strongly encourages all other entities to use them. Three of them cover this incident directly:

• Control 1-10-3: the awareness program covers secure handling of email and phishing, internet browsing and social media use.
• Control 2-2-3-3: authorization based on need-to-know and need-to-use, least privilege and segregation of duties.
• Control 2-3-3-1: protection of workstations and servers from viruses, suspicious programs and malware using modern technologies.

The Origami view

We see the same pattern that brought down Binance in Saudi companies: one device the employee uses for work, browsing, job hunting and trying every new tool, with full admin rights because it is easier. An attacker needs no sophisticated exploit if the employee will run the file himself.

The fix is not to stop staff from learning or trying AI tools, but to let them try them somewhere that cannot reach money and data. When we build systems for clients, we separate day-to-day accounts from privileged accounts from the start, and log every access to them.

Conclusion

A $6.34 billion breach did not start with a server vulnerability, but with a job interview and an app downloaded from search. Set aside an hour this week with your IT lead: remove local admin rights from staff, write down the approved software list, separate devices with sensitive access, and tell your team that no file from a recruiter is opened on a work device. If you want a review of the permissions in your systems, contact us or see our services.