Binance’s chief security officer described the danger of fake recruitment interviews and malicious coding tests in July, months before a similar tactic helped attackers steal approximately $6.34 billion from the cryptocurrency exchange. Jimmy Su’s earlier remarks, reported in new detail by Cointelegraph on November 12, show that Binance had recognised the approach and was already testing employees against bogus recruiters.
Su told the publication that attackers could tailor job offers to an employee, then ask the target to download or run code during a seemingly routine technical assessment. He described the scenario as “something we worry about a lot internally.” In September, according to Binance’s subsequent investigation, a software engineer seeking another job downloaded a malicious assignment onto a work computer during a staged interview.
The similarity does not establish that Su knew an attack was underway in July. The account of the coding-assessment risk was drawn from an interview conducted before the breach, with additional details published after Binance released its incident report. It does show a recognised threat getting past technical safeguards during a months-long campaign.
July warning described the same coding-assessment trap
In Cointelegraph’s July 26 coverage, Su said Binance’s internal red team ran monthly phishing simulations, including fake recruitment approaches. Employees who failed received additional training, and repeated failures could affect their performance assessments. The company had been conducting such exercises for three to four years, he said.
The fuller interview account published November 12 adds a more specific mechanism: a recruiter persuades an employee to run a coding assignment that appears to use ordinary tools, such as a repository downloaded from GitHub. Su said each individual step might appear legitimate, making conventional antivirus systems less likely to flag the activity before malicious instructions execute.
He also placed responsibility on the company to detect dangerous activity when employees explore external jobs using corporate devices. “The onus is on us to detect it,” he said. The security chief’s stated approach was not to forbid all job searching but to stop unsafe execution on equipment connected to the business.
The line between a suspicious interview and ordinary recruiting can be thin. In the later attack, the supposed employer used a legitimate job platform and a video interview before requesting a code download. A normal-looking process, until the software ran.
Binance says attackers reached wallet systems in stages
Binance’s November 3 preliminary findings describe more than one entry point. In June, a wallet DevOps engineer downloaded a tampered Homebrew installer while attempting to set up an AI coding tool. Binance detected the issue, replaced the device and rotated credentials, but said the episode exposed information about the engineer’s role and coworkers.
In September, another engineer was approached by a fake project director, interviewed by a supposed HR representative and then by someone pretending to lead a fictitious company. Near the end of the second meeting, the employee downloaded a repository containing malware. The setup process executed code that evaded the endpoint protection system and communicated with an external server.
By October 20, investigators say the attackers used the compromised computer and an internal AI tool to access two employees involved in wallet operations. On October 29 they used stolen credentials to deploy a container and reach a transaction-signing service. Funds began leaving Binance hot wallets at approximately 20:05 UTC.
That sequence goes beyond a single successful phishing message. Binance’s account involves several compromised devices, credential access, internal tooling and wallet signing. It also illustrates why employee-awareness simulations cannot substitute for controls limiting what an infected workstation can authorize.
Once inside the signing environment, the attackers used Ethereum’s EIP-7702 delegation feature to grant execution permissions to an attacker-controlled contract. Binance had to revoke that permission separately from its normal withdrawal pause. A previous DaveFinances examination of 50 suspicious authorizations in the Binance incident detailed how the onchain permissions remained active for nearly four hours. Those records document the effect on a wallet, not how the initial malware was installed.
Security drills did not prevent the $6.34B theft
Binance says it blocked 57 suspected North Korea-linked cyber threats during 2026, including fraudulent interviews, infected development packages and fake conferencing applications. That count documents attempted attacks detected by the company, not 57 versions of the October incident or a proven success rate for its training programme.
The FBI attributed the October 29 theft to North Korea’s TraderTraitor operation on October 31, and urged cryptocurrency businesses to disrupt transactions involving identified laundering addresses. Attribution by law enforcement does not reveal which individual carried out each stage of the intrusion.
Binance said on November 3 that approximately $2.85 billion in stolen assets had been frozen or intercepted and that 98% of impacted token assets had been replenished. Neither figure means the stolen coins had all been recovered. The exchange previously began reopening customer withdrawals by network on November 1, while continuing investigations and replacing assets with its own resources.
It has since rebuilt affected wallet systems, replaced compromised devices, revoked credentials and tightened access controls. An independent security review is planned. Some remediation details are being withheld for security reasons, so the public report does not establish whether every failure point has been fully addressed.
Investigators are still tracing the proceeds. As DaveFinances reported on Elliptic’s November 9 findings, researchers have connected more than 20,000 addresses to subsequent movement and attempted laundering of the original theft. These are transfers of already stolen assets, not fresh losses to add to the $6.34 billion.
Su’s July remarks are notable because they described a credible technical route into employee devices before that route appeared in Binance’s own post-incident account. The warning was there. Whether improved endpoint controls or stricter separation of developer permissions could have interrupted this particular chain remains a question for the independent review, not a conclusion supported by the released findings.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.