Binance details fake-interview scheme used to breach employee

Binance has disclosed that attackers posing as recruiters tricked an employee during a bogus hiring process and used that access to attempt to steal cryptocurrency, according to Crypto Briefing. The outlet reports the intrusion originated from a DevOps engineer's laptop, which had been infected and ultimately provided a path into a service container tied to withdrawal operations.

Crypto Briefing says the tactic fits a known pattern called the Contagious Interview campaign, which has been tied to North Korean operatives and a group tracked as WaterPlum. Under this scheme, job applicants are reportedly told to run a coding exercise on their personal computer, and the exercise file secretly carries malware that hands remote control to the attacker.

Citing a joint international advisory, the outlet reports the campaign ran from December 2025 through July 2026 and in that stretch reportedly compromised more than 30,000 devices and touched 7,000 crypto wallets, with roughly $10.7 million moved overall. Crypto Briefing notes the technique has also been connected to hacking groups beyond WaterPlum.

The report does not state how much, if any, crypto was taken from Binance specifically in this case, and it does not name the employee involved. The outlet also leaves unconfirmed the exact malware contained in the coding test files and whether Binance absorbed any direct financial loss from the intrusion.