Binance says it fended off multiple cyberattacks linked to North Korean threat actors over the past week. According to the exchange, none of them compromised its systems, and no assets were lost.
The attackers did not try brute force. They tried a job interview.
Binance tied the attempts to a social engineering campaign called “Contagious Interview,” which uses fake hiring processes to get people to run malicious software on their own machines.
How the attack works, and how Binance stopped it
Binance made the announcement on October 27, 2026. It said the blocked attempts had taken place over the previous week.
The Contagious Interview playbook leans on deception. Targets are approached with what looks like a legitimate job opening, then guided through interviews and coding tests. At some point, the candidate is nudged into executing code that turns out to be malicious.
The coding test is the clever bit. Developers run unfamiliar code all the time, so a request to download a project and execute it can feel completely routine. That familiarity is the bait.
Binance reported that no systems were compromised and no assets were lost. In response, the exchange urged both users and its own staff to stay alert to unauthorized software and unverified code.
The company framed employee awareness and internal security monitoring as core defenses.
A crowded threat landscape
The disclosure lands as concerns grow over North Korea’s cyber activity aimed at the crypto sector. Recent reports have pointed to incidents involving suspected North Korean groups, including the Lazarus Group and SquidSquad, in a range of exploits and fund thefts.
One recent example hit close to home for Binance. On October 8, 2026, a $2.84 million drain from the BNB Chain was attributed to SquidSquad.
That incident and this week’s blocked attempts are different events. One reportedly succeeded in taking funds from a network, while the other, according to Binance, failed to get past the exchange’s defenses.
What this means for exchanges and their users
For Binance, the outcome is a win it can point to. Blocking a coordinated campaign without losses suggests its layered security approach, combining technical controls with continuous monitoring and threat detection, did its job this time.
For individual users, the guidance from Binance is simple and worth repeating. Treat unsolicited job offers with suspicion, especially those that involve downloading and running code. Avoid unauthorized software. Verify before you execute.
Job seekers in crypto face a particularly awkward dilemma. The industry hires heavily through remote, informal channels, and technical tests are a standard part of the process. That makes it hard to tell a genuine opportunity from a carefully staged trap, which is exactly what the attackers are counting on.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.