Binance Lost $6.3B to a Fake Interview. Make Your Outreach Checkable

Binance's record $6.3B theft started with a fake job interview: a "Project Director," a friendly HR screen, a "CEO" round, and then a code assignment that one engineer downloaded onto his laptop. Real recruiters take every one of those steps every week. So if you do recruiter outreach to software engineers, and especially to infra, DevOps and crypto engineers, your first message now has to be something the engineer can check in under a minute without replying to you.

What happened in the Binance hack fake job interview?

North Korea-linked attackers ran a fake hiring process with two rounds and only delivered malware in the second one. Binance's security tools did not catch it.

Here is the sequence as reported by CoinDesk, Axios and others:

• September 2026: Someone posing as a Project Director contacts an engineer whose profile mentioned his Binance experience.
• Round one: A fake HR screen. The "HR" persona shares a social media account full of personal photos and videos.
• Round two: An interview with the "CEO" of a company that does not exist. It ends with the engineer downloading a malicious code-repo "assignment."
• Oct 20: The attackers use the infected laptop, plus an internal AI tool, to reach the machines of two wallet engineers.
• Oct 29: They use stolen credentials to deploy a container.
• Nov 3: The attack is made public. Binance's chief security officer, Jimmy Su, briefs reporters.

Two details are less certain than the headlines make them sound. Fortune's headline says LinkedIn, but Binance's own report only says "a legitimate job-hunting platform," and Reuters doesn't confirm LinkedIn either. Coverage of the second round describes a video interview, and whether a chat app was involved is unconfirmed. Neither point changes the lesson. The attackers didn't need a specific platform. They needed a hiring process that looked normal.

Binance also says it blocked 57 suspected North Korea-linked attempts in 2026, and it no longer lets staff in non-public-facing roles keep LinkedIn profiles.

76%

Why does a real recruiter's process now look like an attack?

It looks like an attack because the attackers copied it step for step. Your outreach, your screen, your founder call and your take-home are public, standardized, and free to imitate.

Contagious Interview is the name Microsoft and other researchers use for a North Korean campaign in which attackers pose as recruiters and deliver malware through fake technical interviews. Microsoft says it has been running since at least December 2022. Binance is the largest victim so far, but the pattern goes back years:

• Sky Mavis: Lazarus targeted a senior engineer through LinkedIn in the Ronin/Axie hack.
• CoinsPaid, 2023: Fake job interviews led to a $37M theft.
• Fireblocks: The company confirmed attackers impersonated its recruiters on LinkedIn to spread malware through fake interviews.
• September 2026: Agencies from Japan, the US, Australia and Germany issued a joint advisory on WaterPlum and Contagious Interview.

A fake recruiter spends almost nothing to look like you, because looking like you means the same message template, the same persona and the same take-home everyone uses. When the real thing and the fake are identical, the engineer's only safe move is to ignore both. That is the trust tax every legitimate sender now pays.

The take-home repo is the dangerous step, not the first message

In the Binance attack, the malware came in round two, after trust had been built, as a repository the engineer was asked to download. The first message was harmless. The assignment was the weapon.

Microsoft describes the typical Contagious Interview move this way: the candidate is told to clone and run a package from an ordinary-looking repository. A normal "clone our repo and get the tests passing" take-home asks for exactly the same thing. Microsoft's advice is to run coding tests and take-homes inside an isolated, non-persistent virtual machine, which tells you how routine take-home assignment malware has become.

A real-looking repo doesn't prove much either. Atlassian, which has taken down hundreds of Contagious Interview repositories and accounts on Bitbucket, found that some infected victims uploaded copies of the malicious repos from their own legitimate accounts. That means a repo with a long-lived account and a real commit history can still be poisoned. Account age only counts if the account belongs to the company.

Once you ask an engineer to clone and run your repo, your hiring process and the attacker's look the same.

The fix is a browser-based assessment, meaning a coding exercise that runs in a hosted environment the candidate opens in a browser, so nothing executes on their machine. If you really need a repo:

1. Host it under your company's own verified organization, not a recruiter's or contractor's personal account.
2. Remove install scripts, post-install hooks, and anything that runs automatically.
3. Tell the candidate in writing to run it in a disposable VM, and mean it.
4. Let them review the code and talk it through without running it at all.

How to prove a recruiter is legitimate in under 60 seconds

Give the engineer checks that live somewhere other than the platform your message came in on: your company domain, your company's careers page, and your company's team page. A badge on the same platform the scam used proves very little.

Platform verification helps, but it has limits. LinkedIn says its tools have verified 115 million members and more than 700,000 companies, and admins of verified company pages can now remove people who falsely claim to work there. Still, scammers have hijacked dormant verified accounts and posted through real verified company pages. A checkmark tells the engineer the account was real at some point. It doesn't tell them who is using it today.

Here is a checklist a first message should pass:

1. Send from the company domain. Never a Gmail address. Kraken's public guidance is blunt: if it isn't from @kraken.com, it isn't Kraken.
2. Link the live role on your own careers page. It should be on the company's domain, not a PDF, a Notion page or a job-board mirror. Founders love "stealth" roles, but a role nobody can see is a role nobody can verify. You can post "Senior Infrastructure Engineer, confidential project" and still keep the details private.
3. Name the hiring manager and link a footprint someone else can confirm. That means a listing on the company team page, conference talks, or public commit history. Photos and videos don't count, because the Binance attackers' HR persona had plenty of both.
4. Spell out the process up front. Say how many rounds there are, that the assessment runs in a browser, and that you will never ask them to run code locally. Give a clear timeline with no penalty for taking time to check you, because urgency is how attackers get people to skip checks.
5. Keep it on email and company-controlled video. Say in the first message that you will never move the conversation to Telegram or another chat app. Trex's recruitment-fraud notice is a good template: the company never contacts candidates "through social media, text messages, or third-party messaging platforms."
6. Offer a way to check you that doesn't go through you. That could be a security@ address or the main company line, so they can confirm you exist before replying.

There's one more line that does a lot of work: say where you found them. "I found you through your commits to X" is checkable. "Your profile caught my eye" is what the Binance attacker could have written. This is where Refolk helps beyond the search itself. It returns the public evidence behind every match (the repo, the talk, the paper), so you can cite something specific and verifiable instead of a vague compliment.

Where did the infra and crypto engineers go?

The engineers you most want are now the hardest to find by title. The Binance engineer was singled out because his profile mentioned Binance, Binance has since banned LinkedIn for non-public staff, and Refolk's index finds just 1 infra profile worldwide with crypto keywords in its headline.

These counts only include exact title and headline-keyword matches, so read them as how many people are findable, not how many exist.

1

The single infra match is the number that matters. Wallet and infra engineers sit closest to what attackers want - the Binance attackers went from one laptop straight to two wallet engineers' machines - and this data fits the idea that they don't advertise what they work on. It doesn't prove it, but it's the pattern Binance's own policy would produce. There's also a concentration risk in the smaller market: one firm, OIS Solutions, accounts for 6 of the 25 profiles sampled in Singapore and the UAE (24%). Sourcing by title there means repeatedly reaching the same few teams.

That leaves anyone hiring for crypto infra with a role that's hard to fill. The few people who are findable by title get every message. The rest are invisible to a headline search, and after Binance they have every reason to treat an unknown sender as a threat. Weeks of sourcing can end with a handful of names and no replies.

How to find engineers who hide from LinkedIn

Search for the work instead of the title. Engineers who keep crypto out of their headline still leave public evidence of what they do, and that evidence also makes your first message checkable.

Where to look:

• Open-source contributions. Commits to wallet libraries, node clients, key-management tooling, or the infra those systems run on.
• GitHub activity. Who reviews pull requests on those projects, not just who merges them.
• Conference speaker lists. Infra and security talks at crypto and cloud-native events, where the speaker list is public and the talk is recorded.
• Company engineering blogs. Bylines on posts about incident response, custody architecture, or deployment pipelines.

This kind of search is hard to do by hand across GitHub, LinkedIn and the open web at the same time, and it's the gap Refolk closes. You describe the person in plain English and get back a ranked shortlist, with the evidence for each match attached.

Then send the checkable version: company-domain email, the live role, the hiring manager's team-page listing, a one-line statement that the assessment runs in a browser, and the exact commit or talk that brought them to your attention. An engineer who chose to hide from LinkedIn will be suspicious of any message, but they can verify that one in under a minute. A fake recruiter can't pass the same checks.

FAQ

Are take-home assignments still safe to use?

Take-homes are fine. A repo the candidate has to clone and run is not. Microsoft says Contagious Interview delivers malware through exactly that step, and it recommends running any such code in an isolated, non-persistent virtual machine. Switch to browser-based assessments. If you must use a repo, host it under your company's verified organization, remove anything that runs on install, and offer a code walkthrough as an alternative to running it.

How can an engineer tell a real recruiter from a fake one?

They should check you somewhere other than the channel your message came through. A real recruiter writes from the company domain, links a live role on the company's careers page, and names a hiring manager who appears on the company team page or has public talks or commits. They never move the conversation to a chat app and never ask the candidate to run code on their own machine. If any of those checks fails, the engineer should treat the message as hostile.

Should I stop cold outreach to crypto and infra engineers?

No, but you should change how you do it. The engineers who matter most are the hardest to find by title, so find them through open-source contributions, GitHub reviews and conference talks, and cite that evidence in your message. A specific, checkable first message from a company domain is the kind most likely to get a reply from someone who has read about Binance.