According to Binance co-CEO Richard Teng, hackers ran a series of fake job interviews with an engineer in September, ending in a coding exercise that contained hidden malware.
The fake job interview is a long-standing technique, documented since 2022 and tied to North Korea-linked actors.
Companies and candidates should adopt one simple reflex: never download or run a file provided during a hiring process without verifying it first.
A job interview is by nature a moment of trust: the candidate wants to convince, the recruiter wants to assess. That is precisely what hackers exploit. The Binance hack, targeting the world's largest crypto exchange, is a striking example, and the risk extends well beyond the crypto sector. For recruiters, including in Luxembourg, the fake job interview is now a security issue in its own right.
According to CNBC, Binance says hackers used fake job interviews, malicious software and compromised internal AI tools to infiltrate its wallet infrastructure in the Oct. 29 attack. Speaking to the network on Nov. 3, 2026, co-CEO Richard Teng rejected the idea of a single point of failure, such as one employee's laptop: the attackers, he said, "spent months building their way in."
The attack unfolded over several months. In June, the attackers reportedly set up a fake version of a developer tool to lure an engineer into installing it. A security report published by Binance states that a Binance Wallet DevOps engineer had downloaded a tampered Homebrew installation. The suspicious activity was detected and the device replaced, but by then the engineer's role and that of his colleagues on the wallet infrastructure team had been exposed. In September, the attackers posed as recruiters and ran a series of job interviews with another engineer, ending in a coding exercise that contained hidden malware designed to evade security. They then moved through the internal AI tools until they reached the system that authorizes wallet transactions.
On attribution, Teng himself did not attribute the attack to North Korea, but acknowledged that the FBI has linked it to the North Korean group TraderTraitor. The firm TRM Labs had reached the same conclusion "with high confidence," according to US media outlets in the TNND network. Binance says it has replenished 98% of the $6.34 billion in affected assets, rebuilt the affected wallet system and internal AI tool, and brought in an independent expert to review its work. In a Reuters report carried by The Express Tribune, Teng said the teams were "working non-stop" to make users whole.
This trap is nothing new. The campaign dubbed "Contagious Interview" was described as early as 2023 by Palo Alto Networks' Unit 42 research team. As The Hacker News reports, its aim is to infect software developers with malware through a fictitious job interview, often using npm packages or GitHub repositories presented as simple technical tests. According to a more recent report from the same outlet, dated September 2026, the campaign, active since at least 2022, has compromised at least 30,000 devices in more than 100 countries and siphoned funds or account credentials from over 7,000 cryptocurrency wallets.
Binance has long been aware of the problem. Its chief security officer, Jimmy Su, told Decrypt that the exchange receives fake resumes every day that it attributes to North Korean actors. According to him, the attackers even recruit their targets for a high-level job, paying "twice, three times as much" just to get them onto an interview. Founder Changpeng Zhao also sounded the alarm in 2025: according to Cryptonews, he describes these hackers as "advanced, creative and patient." Finally, on Oct. 27, 2026, Binance said, as reported by Crypto Briefing, that it had blocked other attempts tied to this campaign.
The attackers also play both sides, posing as recruiters or as job candidates with fake identities. For HR teams, identity verification is now part of the hiring process.
Luxembourg is not immune. With its image as a land of opportunity, the Grand Duchy is a natural target, as Paperjam points out in its investigation into "job scams." For several months, candidates have said they were approached via WhatsApp, LinkedIn or Telegram by alleged recruiters, and the recruitment agency Hays Luxembourg has published an alert about the growing number of fake profiles impersonating its staff. An expert quoted by the outlet notes that artificial intelligence now makes it possible to send messages in very correct Luxembourgish. These scams mostly target candidates' data or money, while the technical fake job interview mainly targets IT and finance profiles, which are very present in Luxembourg.
Best practices are well known. For candidates, this means checking that the recruiter and the company exist through an official channel, being wary of an offer that is too generous or a process that moves too fast, and refusing to download any software or executable exercise outside an isolated environment. For employers, it means informing teams with access to sensitive systems and providing secure testing environments. The Grand Ducal Police also publishes prevention advice against various types of scams.
The Binance case shows that a fake job interview can be enough to bypass costly technical defenses, because it targets a human being in a position of trust. For HR teams, the stakes are twofold: protecting candidates, whose employer brand can be impersonated, and employees, who can be approached by fake recruiters.
The reflex comes down to one sentence: be wary of any unsolicited offer that involves downloading code, and verify before you run. This means informing teams, providing secure testing environments and building vigilance against the fake job interview into hiring practices, so that this reflex becomes a collective habit.
What is a fake job interview in cybersecurity?
It is a fake hiring process set up by hackers to get someone to install malicious software, usually under the guise of a technical test, a video conferencing update or a coding exercise.
How can you spot a fake recruiter?
Warning signs include unsolicited contact, unusually high pay, a very fast process and, above all, a request to download or run a file. Verify the recruiter's identity through the company's official channels.
Are Luxembourg companies affected?
Yes. Paperjam reports a rise in fake job offers and recruiter impersonation in Luxembourg. In-demand IT and finance profiles are potential targets.
.jpg)
.jpeg)
