Binance CSO's Warning Preceded $6.3B Hack Tactic

Binance Security Chief Warned of Fake Coding Tests Months Before Record Hack

Months before Binance suffered a record-breaking $6.3 billion hack, its chief security officer had detailed how a deceptive job interview could provide attackers with an entry point into the cryptocurrency exchange, a method that closely mirrors one of the attack vectors later exploited.

In a July interview discussing Binance’s strategies against escalating security threats, Jimmy Su informed Cointelegraph that fake job interviews were a significant internal concern. He explained how malicious actors could craft a job offer specifically for an employee, then persuade them to execute code as part of a supposed technical assessment.

“Once that code is executed, the device is compromised, and they can begin harvesting credentials,” Su stated, adding that this would enable attackers to gain further access into the network.

Su’s detailed warning about these deceptive coding assessments was not highlighted in Cointelegraph’s July reporting but has gained considerable significance following the largest hack in cryptocurrency exchange history.

In September, a Binance software engineer downloaded a malicious coding assignment onto his work computer during a simulated job interview. According to Binance’s preliminary investigation, this compromise was a crucial step in the multi-stage attack that culminated in the October theft.

During his July interview with Cointelegraph, Su also anticipated why security tools might fail to detect such a ruse. He explained that a technical assessment could involve seemingly legitimate actions, such as downloading a code repository from GitHub.

“Each step is actually legitimate on its own. So, many antivirus tools may not be able to detect it and flag it,” he said.

Binance’s subsequent investigation revealed a similar detection failure. The exchange stated that the assignment’s setup process executed malware that evaded its endpoint security tools through obfuscation and other evasion techniques.

Su emphasized to Cointelegraph that it was Binance’s responsibility to mitigate risks when employees pursued outside opportunities on company devices.

“Of course, employees can explore outside opportunities. What we do worry about is that they do so on the company device,” he said. He added that if an employee fell for a fake interview, “the onus is on us to detect it” and to “stop the actual execution of that code.”

Proactive Measures and Evolving Threats

Binance had already been testing employees against simulated recruiters. Su mentioned that its internal red team had been conducting monthly phishing simulations for three to four years, providing remedial training for those who failed.

“In the beginning, the security hygiene left a lot to be desired. But after this amount of time, the company has improved significantly,” he noted.

Kevin Gibson of recruitment firm Proof of Search told Cointelegraph that the threat is also influencing how some crypto employers vet prospective hires. Clients are increasingly inquiring whether candidates have been met in person.

“A number of our clients are now asking us straight up whether we’ve met a candidate in person,” Gibson said, adding that candidates personally met by a third-party recruiter have an advantage.

Employees, as demonstrated in Binance’s case, can also become targets.

“In crypto, a dodgy job offer or a ‘quick catch-up call’ can be the first step in a multimillion-dollar hit,” he warned.

Binance reported blocking 57 suspected North Korea-linked cyber threats this year, averaging approximately one attack every five days.

Following the October attack, Binance announced it had implemented tighter device controls, rebuilt affected wallet systems and internal AI tooling, strengthened access controls, and revoked compromised credentials. The exchange also stated it was increasing investment in endpoint protection and developer-environment security, and engaging independent cybersecurity experts to review the incident. Some technical details and security measures will remain confidential, the company said.