Binance says hackers used a fake job interview to steal crypto

An employee was reportedly compromised through a bogus hiring process, a tactic tied to North Korea-linked campaigns targeting the crypto industry Hackers posed as recruiters, ran a fake job interview, compromised a Binance employee, and walked away with crypto. That is the core of what the world’s largest crypto exchange has disclosed. The technique matches a pattern known as the “Contagious Interview” campaign. It has been linked to North Korean operatives and to other groups, including one tracked as WaterPlum. The scheme usually begins on professional networking sites such as LinkedIn. Attackers pose as recruiters and approach developers or staff at crypto firms with what looks like a real job opportunity. The conversation then moves to a technical interview. At some point, the candidate is handed a coding test to complete on their own machine. That test is the trap. The files contain malware, and running them hands the attacker access to the victim’s computer. Scale of the campaign The Contagious Interview campaign was reportedly active from December 2025 to July 2026. During that window, it reportedly infected over 30,000 devices and affected 7,000 crypto wallets. A joint int...