TLDR
- Binance lost $6.3 billion in an October 29 hack by a North Korea-linked group.
- A Binance engineer downloaded a fake coding test in September, which started the attack.
- Security chief Jimmy Su described this exact trick in a July interview.
- US exchanges follow different state rules, not one federal cybersecurity standard.
- Binance says it blocked 57 suspected North Korea-linked threats this year.
In July, Binance chief security officer Jimmy Su told Cointelegraph that fake job interviews were something the exchange worried about a lot. He said attackers could tailor a job offer to an employee and then ask them to run code as part of a technical test. Months later, Binance lost $6.3 billion in what experts call the largest crypto theft ever.
Binance's Internal 'Red Team' Runs Monthly Phishing Tests; Repeat Failures May Lead to Dismissal
Binance Chief Security Officer Jimmy Su said the exchange's internal Red Team conducts simulated phishing attacks against employees every month to assess security awareness.… pic.twitter.com/t2QMxXoJ0w
— Wu Blockchain (@WuBlockchain) July 26, 2026
Su said the danger starts once the code is run. “The device is compromised and then they can start harvesting credentials,” he said. Attackers could then move deeper into the network.
His warning was not part of Cointelegraph’s July coverage. It has taken on new meaning since the October attack.
How the Attack Unfolded
According to Binance’s early investigation, a software engineer downloaded a malicious coding assignment onto his work computer in September. This happened during a fake job interview. That step became part of a multistage attack.
The theft took place on October 29. Reuters reported it unfolded in a matter of minutes after months of planning. Experts have linked the attack to an elite North Korean hacking group.
Su had also explained why security tools might miss such a trap. A test could include steps like downloading code from GitHub, which look normal on their own. “A lot of the anti-virus tools may not be able to detect it and flag it,” he said.
Binance’s investigation described a similar failure. The assignment’s setup process ran malware that avoided the exchange’s endpoint security tools. It used hiding techniques and other evasion methods to do so.
Su said it was Binance’s job to contain the risk. “Of course employees can explore outside opportunities,” he said. “What we do worry about is that they do so on the company device.”
He added that if an employee fell for a fake interview, “the onus is on us to detect it.” Binance’s red team had run monthly phishing tests for three to four years. Employees who failed received extra training.
Experts Question Exchange Defenses
Jonathan Alexander, chief technology officer of S&P Global’s OpenZeppelin, said social engineering is a well-known threat. He said the bigger question is why exchanges lack stronger internal safeguards. Those could stop an attacker from gaining wider access after breaching one engineer’s computer.
Alexander said some crypto advocates resist controls such as spending limits. They view them as conflicting with blockchain’s decentralized values. “You can have security controls and have protections against that,” he said.
Alex Pruden, CEO of Project Eleven, said defenders face a basic disadvantage. Attackers only need to succeed once. He expects more spending on safeguards for internal AI tools that could be turned against a company if compromised.
Kevin Gibson of recruitment firm Proof of Search said hiring is also changing. Clients now ask whether recruiters have met candidates in person. He said a “dodgy job offer” can be the first step in a multimillion-dollar hit.
Chainalysis data shows more than $22.3 billion has been stolen from crypto platforms since 2021. Unlike banks, US exchanges do not follow a single federal cybersecurity system. Rules depend on where firms operate and which state licenses they hold.
New York’s Department of Financial Services requires licensed firms to keep cybersecurity programs, use multi-factor authentication and name a chief information security officer. Other states mainly apply money-transmitter rules. These often do not set specific technical controls such as encryption standards.
Binance said it blocked 57 suspected North Korea-linked cyber threats this year, about one every five days. After the attack, it tightened device controls and rebuilt affected wallet systems and internal AI tooling. It also strengthened access controls, revoked compromised credentials and hired independent experts to review the incident.
