Binance just confirmed attackers used LinkedIn to pose as recruiters, conduct fake interviews and send a malicious coding assignment to a Binance engineer’s work laptop – ultimately gaining access to systems tied to the company’s wallets. Commentary from Fortra cybersecurity experts below on the risks of using corporate devices for external assessments, controls around downloads, execution and permissions, and how one compromised developer environment can expose sensitive financial infrastructure.
.Gina Cardelli, Director of Platform and Threat Intelligence at Fortra
“My questions would be around the security controls surrounding that employee’s environments. An engineer seeking a new job downloaded a malicious coding assignment, giving attackers a foothold in a campaign that ultimately gained access to the company’s wallets. While using a work computer for an external coding assessment warrants its own scrutiny, the larger concern is how that compromise enabled access to other systems and sensitive financial infrastructure.”
Tyler Reguly, Associate Director, Security R&D at Fortra
“It has long been said that the cost of hiring a new employee is significantly higher than paying to retain an existing employee. It seems to for Binance, that cost was astronomically higher. In a world where quiet quitting exists, it should come as no surprise that employees are interviewing on company time. Organizations need to counter this with adequate controls in place. Particularly, controls around what can be downloaded and executed on a corporate laptop, as well as the permissions granted to the user. At the end of the day, Developer laptops are among the hardest devices in an organization to look down safely without being detrimental… organizations need to find the balance point.”
Rohan Gupta, CEO & Co-founder, Diopter
“Binance deserves credit for publishing a detailed timeline this quickly. The key moment came in Sep, when an engineer met on video with the CEO of a company that didn’t exist, trusted what he saw, and ran the code he was given. Everything technical that followed depended on that one conversation going the attacker’s way.
When Binance caught a tampered AI tool in Jun, it replaced the device and changed credentials, but new credentials couldn’t erase what the attacker had already learned about who was on the wallet team. Once attackers know who holds the keys, they often go after those people directly, and a recruiter’s pitch is one of the few approaches a target is likely to welcome without suspicion.
Expect more fake hiring processes aimed at engineers with privileged access, complete with fake executives on video calls. Security teams should treat recruiting outreach to those engineers as part of the attack surface and keep interview code off any machine near production. They should also confirm who’s on the other end of a video call before anyone acts on what was said. Binance says it’s increasing its investment in AI-enabled detection, and that detection has to run during the live conversation, before anything gets downloaded.”
The more that is learned about the Binance hack, the scarier it is. This should be required reading as clearly there’s lessons for everyone.
Related
This entry was posted on November 3, 2026 at 1:20 pm and is filed under Commentary with tags Binance. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Fake LinkedIn Job Interview Leads to Binance Hack
Binance just confirmed attackers used LinkedIn to pose as recruiters, conduct fake interviews and send a malicious coding assignment to a Binance engineer’s work laptop – ultimately gaining access to systems tied to the company’s wallets. Commentary from Fortra cybersecurity experts below on the risks of using corporate devices for external assessments, controls around downloads, execution and permissions, and how one compromised developer environment can expose sensitive financial infrastructure.
.Gina Cardelli, Director of Platform and Threat Intelligence at Fortra
“My questions would be around the security controls surrounding that employee’s environments. An engineer seeking a new job downloaded a malicious coding assignment, giving attackers a foothold in a campaign that ultimately gained access to the company’s wallets. While using a work computer for an external coding assessment warrants its own scrutiny, the larger concern is how that compromise enabled access to other systems and sensitive financial infrastructure.”
Tyler Reguly, Associate Director, Security R&D at Fortra
“It has long been said that the cost of hiring a new employee is significantly higher than paying to retain an existing employee. It seems to for Binance, that cost was astronomically higher. In a world where quiet quitting exists, it should come as no surprise that employees are interviewing on company time. Organizations need to counter this with adequate controls in place. Particularly, controls around what can be downloaded and executed on a corporate laptop, as well as the permissions granted to the user. At the end of the day, Developer laptops are among the hardest devices in an organization to look down safely without being detrimental… organizations need to find the balance point.”
Rohan Gupta, CEO & Co-founder, Diopter
“Binance deserves credit for publishing a detailed timeline this quickly. The key moment came in Sep, when an engineer met on video with the CEO of a company that didn’t exist, trusted what he saw, and ran the code he was given. Everything technical that followed depended on that one conversation going the attacker’s way.
When Binance caught a tampered AI tool in Jun, it replaced the device and changed credentials, but new credentials couldn’t erase what the attacker had already learned about who was on the wallet team. Once attackers know who holds the keys, they often go after those people directly, and a recruiter’s pitch is one of the few approaches a target is likely to welcome without suspicion.
Expect more fake hiring processes aimed at engineers with privileged access, complete with fake executives on video calls. Security teams should treat recruiting outreach to those engineers as part of the attack surface and keep interview code off any machine near production. They should also confirm who’s on the other end of a video call before anyone acts on what was said. Binance says it’s increasing its investment in AI-enabled detection, and that detection has to run during the live conversation, before anything gets downloaded.”
The more that is learned about the Binance hack, the scarier it is. This should be required reading as clearly there’s lessons for everyone.
Share this:
Like this:
Related
This entry was posted on November 3, 2026 at 1:20 pm and is filed under Commentary with tags Binance. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.