The Hiring Safety Playbook

Binance was hacked through a job interview

On 29 October 2026, attackers took about $6.3 billion out of Binance, the largest crypto theft on record. The FBI attributes it to North Korea's TraderTraitor group; North Korea denies it. Binance's own account says it started with something every growing company does: a recruiter reaching out to an engineer.

1. June

   A DevOps engineer downloads a tampered Homebrew installer while looking for an AI coding tool. Binance catches it and rotates credentials, but the attackers have already learned his role and who his colleagues are.

2. September

   A second engineer is approached on a legitimate job-hunting platform by a "Project Director". Two interviews follow: one with a fake HR contact who shares personal photos and videos to build trust, one with a fake "CEO" on a chat app.

3. The assignment

   At the end of the second interview he is asked to download a technical "assignment" onto his work computer. It contains malware that runs during setup and is not picked up by Binance's endpoint tools.

4. 20 October

   The attackers use that laptop and an internal AI tool to reach two more engineers, and find a token with container-deployment permissions.

5. 29 October

   Using those credentials they deploy a container and call an internal signing service. About $6.34 billion in assets are affected; roughly $2.85 billion is frozen or intercepted by 3 November.

Three ways recruiting gets attacked

Most teams only think about the first. Attackers use all three, often with the same infrastructure.

Set up your candidate trust stack

Eight steps. A small TA team can get through all of them in a week.

1. Step 01

   Name your recruiters

   Candidates can't tell a real recruiter from a fake one unless you tell them who the real ones are.

   • List everyone who recruits for you: TA, founders, HR, ops and any agency, with title and LinkedIn link.
   • Publish it on your careers page and link to it from every job ad.
   • Update it the day someone joins or leaves, and say plainly that anyone not listed is not you.
2. Step 02

   Own one email domain

   A single, published domain gives candidates a simple test, and gives you something to defend.

   • Recruit from one company domain only. Never from personal Gmail, Telegram or WhatsApp.
   • Ask whoever runs your email (Google Workspace, Microsoft 365) to set up SPF, DKIM and DMARC so spoofing you is harder.
   • Register the obvious lookalikes (yourco-careers, yourco-jobs) before scammers do.
3. Step 03

   Publish your hiring stack

   Fakes love tools you've never mentioned. If candidates know your tools, an unfamiliar one is a red flag.

   • List the tools a candidate will meet: video interviews, scheduling, assessments, ATS, onboarding.
   • Keep the list short, and prefer browser-based tools that need nothing installed.
   • State the rule: you will never ask anyone to install software to join an interview.
4. Step 04

   State your agency policy

   "Recruiting on their behalf" is the easiest claim to fake. Take it off the table.

   • No agencies? Say so in one line. Anyone claiming otherwise is not authorised.
   • Using agencies? Name each one, with its email domain and a named contact, and require them to introduce themselves as an agency.
   • Review the list every quarter.
5. Step 05

   Write your "never" list

   A short, absolute list is easier to remember and enforce than a long, nuanced one.

   • We never ask you to install software, run a command or download a file to join an interview.
   • We never ask you for money, equipment deposits, or bank, card or ID details before an offer is signed.
   • Every recruiter and hiring manager reads it and follows it, with no exceptions for "urgent" hires.
6. Step 06

   Publish it where candidates look

   A notice nobody sees protects nobody. Put the same short message everywhere a candidate touches you.

   • Careers page, job-ad template and ATS posting footer.
   • First outreach message, calendar invites, and the auto-reply from your recruiting inbox.
   • Your LinkedIn company page (About section and a pinned post) and your offer email.
7. Step 07

   Make your own process look nothing like a scam

   If your genuine process looks like a scam, candidates can't tell the difference, and neither can you.

   • No take-homes as zip files or repos that candidates must run locally. Use a hosted environment, a live session or a read-only review.
   • No interviews over chat apps and no unannounced platforms.
   • No payment for equipment, no cheques, and no bank or ID details until the offer is signed, collected through your onboarding system.
8. Step 08

   Monitor, log and report

   You can't fix a pattern you can't see. A light monthly routine is enough for a small team.

   • Once a month, search LinkedIn for people using your company name with recruiter titles, and report any you don't know. Admins of a verified company page can remove people falsely claiming to work there, so get your whole TA team verified.
   • Search job boards for ads you didn't post, and watch for new lookalike domains.
   • Log every report: date, platform, fake profile or domain, role advertised, how far the candidate got. After a couple of months you'll see which roles get copied.
   • Report to the platform, and to Action Fraud (UK) or the FBI's IC3 (US).

Protect your own people

Publishing your process protects candidates. These habits protect your colleagues, systems and code when the fake recruiter is aimed at you. Most cost nothing. Take this section to IT.

Your new hire might already be infected

One group infected 30,000+ devices in eight months with fake coding tests. In a niche talent market, that is a meaningful slice of your candidate pool. Attackers don't need to target your people directly. They can infect the market and wait for some of those candidates to get hired.

Spot fake candidates

Recruiters are the front door. These checks help confirm the person who walks through it is who they say they are.

Copy-and-paste templates

Replace the [brackets] and use them as they are. Keep the message identical everywhere candidates meet you.

If something goes wrong

If someone on your team has run something, or a candidate reports a fake recruiter, work through these in order. Loop in IT or security at step one.

1. Disconnect

   Take the affected device off the network. Don't use it to investigate.

2. Rotate from a clean device

   Revoke sessions and change passwords, API keys and tokens the machine could reach. Start with email, cloud, code hosting, deployment and payment access.

3. Assume anything on it is out

   Files, saved passwords, keys and any crypto wallets on that machine are compromised. Replace them from a clean device.

4. Preserve evidence

   Keep messages, profile links, files and screenshots. Don't delete anything.

5. Report

   Action Fraud (0300 123 2040) in the UK; FBI IC3 (ic3.gov) in the US; the platform where it happened; and your own security contact.

6. Wipe or replace

   Fully reset the operating system before reuse. Undetected malware can survive clean-up.

7. Review the blast radius

   What could that person reach? Check for movement to colleagues' machines, as in the Binance case, and log what you learn.

The checklist at a glance

The whole playbook in four groups. Use it as a quick reference, or as the agenda for a working session with IT.