Binance Security Head: Warned about fake interview code attack methods, months later a $6.3 billion theft occurred

Binance's Chief Security Officer Jimmy Su stated in a July interview that fake job interviews could lure employees into running malicious code on company devices, leading to device control, credential theft, and infiltration of internal networks.

In September, a Binance software engineer downloaded a malicious programming assignment to their work computer during a fake interview; Binance's preliminary investigation indicated that this incident was part of a multi-stage attack in the October theft case. Jimmy Su also pointed out that attackers might exploit seemingly normal technical assessment steps to bypass antivirus tools. Binance's subsequent investigation revealed that the installer for the malicious assignment evaded endpoint security tools through obfuscation and other evasion techniques.

Binance stated that it has intercepted 57 suspected cyber threats related to North Korea so far this year, approximately one every five days. After the October attack, Binance announced that it has strengthened device and access controls, rebuilt affected wallet systems and internal AI tools, and increased investments in endpoint protection and development environment security.