North Korean hackers posed as recruiters to breach the crypto exchange, exposing recruitment fraud risks for HR leaders
A fake job interview helped North Korean hackers carry out the largest cryptocurrency theft on record. Binance revealed this week that a sham recruitment process gave attackers the foothold they needed to drain US$6.3 billion (A$9 billion) from the exchange on 29 October 2026.
The world’s largest crypto exchange published its initial incident report after the United States Federal Bureau of Investigation (FBI) blamed North Korea for the attack. For HR leaders, the report shows how the hiring process has become an attack route. Here it was aimed at an employee who was looking to move on, not at a candidate trying to get in.
“This was not a single mistake or a single breach. It was a campaign built over many months,” said Richard Teng, co-chief executive officer of Binance.
Ben Jones, practice lead, cyber security at Coder Trove, told HRD that the case should change how employers think about recruitment risk. “The hiring process has become an attack surface in its own right, for candidates coming in and for employees being approached from outside,” he said.
How a fake job interview got hackers inside Binance
According to Binance, the operation began in June 2026. An engineer on its wallet development team downloaded a software tool that hackers had tampered with, which exposed the roles of that engineer and their colleagues.
In September, a different software engineer who was looking for a new job was approached on a legitimate job-hunting platform. Jones said the sequence that followed was a model of the methods used by the Democratic People’s Republic of Korea (DPRK).
“Binance’s incident report reads like a textbook on DPRK recruitment tradecraft,” he said. “First-round interview with a fake HR rep on a live video call, complete with a social media profile full of personal photos and videos to make them feel real. Second round with a fake CEO over a chat app, where the engineer was told to download a coding assignment from a code repository. That assignment was the malware: custom, previously unseen, built to swap out a legitimate developer tool on the machine and quietly take commands from the attackers. Endpoint protection never saw it.”
The gradual approach was deliberate, Jones said. “Each stage was designed to lower the engineer’s guard a little further, so by the time the assignment landed, trust had been built over weeks and the download felt routine.”
On 20 October 2026, the attackers used that compromised computer, along with an internal artificial intelligence (AI) tool, to take control of the systems of two wallet developers. They launched the theft nine days later. Binance said 233.46 million XRP tokens were moved out of five internet-connected “hot” wallets in four minutes. The final unauthorised transfer came almost four hours after the attack began.
Binance said about US$2.85 billion of the stolen assets had been frozen or intercepted.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” the company said.
North Korea has rejected the FBI’s finding. Kim Yo-jong, the sister of leader Kim Jong-un, described the US claim as “absurd rhetoric and nothing new”, according to The Guardian’s report of comments carried by state news agency KCNA.
A familiar recruitment scam, flipped
Cybersecurity firm Palo Alto Networks has named the tactic “Contagious Interview”. In 2022, according to Bloomberg, a fake job offer to an engineer at the game Axie Infinity preceded a US$590 million theft.
The Guardian noted that North Korean operatives more commonly pose as job seekers. HRD’s October 2026 report on North Korean scammers getting hired, then holding companies to ransom examined that side of the threat. It detailed a New Zealand business that hired a North Korean remote IT contractor, who later threatened to leak commercially sensitive data. The report also cited Recorded Future research showing that one cluster of operatives applied to jobs at more than 1,100 companies.
Jones said Coder Trove had briefed local leaders on both tactics days before the Binance attack. The session was run with Dan Elliott, field chief information security officer (CISO) for Asia-Pacific (APAC) at threat intelligence firm Recorded Future.
“On 27 October we ran an executive briefing for the Australian and New Zealand cyber and HR community with Dan Elliott, Field CISO APAC at Recorded Future, walking through this exact playbook: fake applicants getting hired to sit inside companies, and fake recruiters luring engineers into interviews that deliver malware. Two days later Binance lost $6.3 billion to the second method,” he said.
What should HR leaders take from the Binance hack?
The breach did not run through Binance’s own hiring process. The engineer was job hunting privately, as many employees do. Jones said that is exactly why the risk should not be filed under technology alone.
“There is a tendency to picture a US$6.3 billion heist as some technological marvel. Binance’s own account shows the critical step was a software engineer trusting a recruiter across two interviews,” he said.
Binance said it detected and prevented 57 suspected North Korea-linked threats in 2026. Jones said that record should worry smaller employers. “Binance reports it blocked 57 North Korea-linked attempts this year with world-class security capability. For an Australian business with no dedicated security team, the odds are considerably worse.”
Much of the attention so far has gone to British employers being urged to vet IT hires and other screening of remote candidates. HRD has also reported on offboarding gaps that leave laid-off workers with system access. The Binance case adds a further exposure: current staff being targeted by recruiters who do not exist.
“The practical fix sits with HR and hiring managers: verify identity continuously, treat unsolicited recruiter contact to your engineers as a security event, and never let a candidate or interviewer run code on a corporate device,” Jones said.
Binance said it is increasing investment in AI-enabled threat detection, commissioning a third-party review of the incident and planning a security research fund. The exchange said it is covering customer losses. According to the BBC, it reported that 98 per cent of affected token assets had been replenished as of Saturday.
