Fake Job Interview Scams: 7 Signs After the $6.34B Binance Hack

A fake job interview opened the door to the biggest crypto theft on record. In its initial report published on November 3, 2026, Binance said attackers posing as recruiters persuaded one of its engineers to run a malicious coding “assignment” on his work computer, a foothold that eventually led to about $6.34 billion in digital assets leaving its hot wallets on October 29. The FBI attributes the attack to North Korea.

The scam that hit Binance is not new, and it does not only target crypto companies. Developers, designers and IT staff anywhere can get the same pitch. Below is how the scheme worked and the warning signs to look for before you accept a “take-home test” from a stranger.

How the Fake Job Interview Behind the Binance Hack Worked

According to Binance, the engineer was approached in September on a legitimate job-hunting platform where his profile mentioned his Binance experience. A person posing as a Project Director set up a first-round video interview with an “HR representative,” who shared a social media account full of personal photos and videos to build trust. A second round took place in a popular chat app with someone claiming to be the CEO of a company that does not exist.

Near the end of that second interview, the engineer was told to download an assignment repository onto his work computer. The code ran during setup, quietly swapped a legitimate developer tool (pyenv) for a malicious copy and connected to an attacker-controlled server. Binance says its endpoint security tools did not flag the malware at the time.

From that laptop, the attackers abused an internal AI tool to reach two more wallet engineers, found a container deployment token and, on October 29, used the company’s wallet signing service to move funds. You can follow the full timeline of the theft and the recovery in our Binance hack coverage.

Why Fake Job Interview Scams Keep Working

The pitch plays on ambition and politeness. A well-paid role, a friendly recruiter and a short technical test feel normal in tech hiring, and refusing to run the test can feel like walking away from the job. Attackers also do their homework: they pick targets with privileged access and tailor the offer to their CV.

Binance alone says it detected and blocked 57 suspected North Korea-linked attempts in 2026, using fake interviews, booby-trapped developer tools, poisoned software packages and fake video meeting apps. Chainalysis has tied more than $14.3 million in losses over the past 18 months to similar fake interview schemes and believes those smaller attacks helped the hackers refine the playbook before going after Binance. Security researchers usually call this campaign “Contagious Interview.”

7 Signs of a Fake Job Interview

1. The recruiter found you, and the company is hard to verify

Unsolicited outreach is normal, but check that the company has a real website, real employees on LinkedIn and a job listing on its own careers page. A firm that exists only in chat messages is a red flag.

2. The interview moves to a chat app

Moving from email or a known video platform to Telegram, WhatsApp, Discord or a similar app makes it harder to trace who you are talking to.

3. You are asked to clone and run code

This is the core of the scam. Repositories can run code the moment you install dependencies, build or start the project, before you read a single line.

4. The test has to run on your work machine

No real employer needs your current company’s laptop for a hiring test. That request targets your employer’s network, not your skills.

5. You are told to install a “meeting” app or extension

Fake video conferencing apps and browser extensions are a common way to drop remote access malware, as with the fake Claude Code extension that planted an SSH backdoor on Cursor users in October.

6. Heavy trust building and pressure to hurry

Personal photos, flattering offers and tight deadlines are designed to lower your guard. In the Binance case, the fake HR contact shared a personal social media account to seem genuine.

7. Interest in your access, not your work

Questions about which systems, wallets or production tools you can reach are a warning sign, especially if your profile mentions a high-value employer.

How to Protect Yourself

The FBI advises against running pre-employment tests on company-owned devices. If a test truly requires running code, use a virtual machine on a separate device that is not connected to your company, or a device the tester provides.

Read a repository’s install scripts and dependency list before running anything, verify recruiters through a second channel such as the company’s official site, and never keep production tokens or keys on a machine you use for personal job hunting. If you hold crypto yourself, moving long-term savings to a cold wallet limits the damage if a device is ever compromised.

If you think you already ran a suspicious test, disconnect the device, tell your security team right away and rotate any credentials stored on it. In the United States, scams like this can also be reported to the FBI’s Internet Crime Complaint Center (IC3).