Cryptocurrency exchange Binance said Tuesday that attackers staged job interviews and planted malware in a coding assignment downloaded onto an engineer’s work computer, gaining a foothold in a campaign that culminated in last week’s $6.3 billion theft.
Binance executives identified LinkedIn as the platform used to approach the engineer, Fortune reported.
The company’s preliminary investigation describes attackers moving among employee devices, exploiting internal AI tooling and obtaining credentials with container deployment permissions. The findings expand on the suspected laptop compromise detailed last week, when Binance pledged to cover customer losses using its emergency fund and company reserves.
Gina Cardelli, director of platform and threat intelligence at U.S. cybersecurity company Fortra, said the investigation raises questions about the security boundaries surrounding developers’ computers.
“While using a work computer for an external coding assessment warrants its own scrutiny, the larger concern is how that compromise enabled access to other systems and sensitive financial infrastructure,” she said.
That access raises questions about the permissions and connections available from a developer's environment, not just endpoint defenses.
Fake interviews followed earlier compromise
According to an investigation update posted on social media this week, Binance said the campaign included a June incident in which a wallet engineer downloaded a tampered Homebrew installer while seeking an AI-based coding tool. The organization replaced the device and rotated credentials, but information about the engineer and wallet-team colleagues had already been exposed.
In September, another engineer attended interviews with supposed representatives of a fictitious company. A purported HR representative shared personal social media content to establish credibility. A subsequent interview involved someone claiming to be the CEO.
Binance said the coding assignment itself contained malware that ran during installation and escaped endpoint detection. On Oct. 20, attackers used the compromised computer and internal AI tools to reach two other engineers’ devices and discover a deployment token.
Binance said it has rebuilt affected wallet systems and internal AI tools, replaced devices and disabled associated credentials. An independent cybersecurity review is planned.
Developer access complicates containment
Developers routinely need to download packages, execute unfamiliar code and test software, complicating efforts to restrict what runs on their computers.
“Organizations need to counter this with adequate controls,” said Tyler Reguly, Fortra’s associate director of security R&D.
He said those include controls on what can be downloaded and executed on a corporate laptop, as well as the permissions granted to the user.
Reguly added that developer laptops are particularly difficult to restrict without interfering with employees’ work. That places responsibility on organizations to balance those requirements, rather than assume employees will consistently separate external activities from corporate devices.
For security teams, the two areas to examine are what software employees can introduce into development environments and what permissions remain available after a compromise.
Recruitment becomes a security concern
The campaign illustrates a broader trend: security vendors are expanding social engineering training beyond spotting suspicious emails.
Fable recently introduced voice-phishing simulations covering scenarios such as help desk account resets, vendor payment fraud and executive impersonation.
Those simulations address a related social engineering risk; however, Binance’s published account does not establish that its attackers used AI-generated voices or video.
Beyond the method of contact, researchers point to the recruitment pretext itself as the vulnerability.
Rohan Gupta, CEO and co-founder of Diopter, a social engineering defense company, said the earlier compromise had lasting value for attackers even after Binance replaced the affected device and changed credentials.
“Once attackers know who holds the keys, they often go after those people directly, and a recruiter’s pitch is one of the few approaches a target is likely to welcome without suspicion,” he said.
He urged employers to account for recruitment approaches when protecting engineers with privileged access.
“Security teams should treat recruiting outreach to those engineers as part of the attack surface and keep interview code off any machine near production,” Gupta said.
Nathan Eddy is an award-winning journalist and documentary filmmaker, having reported for decades across topics as diverse as cybersecurity, enterprise IT, architecture, healthcare, and automotive technology. He is a graduate of Northwestern University's Medill School of Journalism. He currently lives in Berlin, Germany.
