Binance's Jimmy Su warned in July of fake-interview coding trap later used in $6.3bn hack

Key points

• Jimmy Su said fake job interviews were "something we worry about a lot internally", with attackers persuading staff to run code during technical assessments.
• Binance says it blocked 57 suspected North Korea-linked cyber threats in 2026, roughly one every five days.

Binance's chief security officer, Jimmy Su, described the fake job interview tactic months before the exchange suffered a $6.3bn hack, Cointelegraph reports. In a July interview, Su said fraudulent recruitment approaches were a major internal concern. Attackers, he explained, could tailor an opportunity to an employee and then persuade them to run code as part of a technical assessment, compromising the device and allowing credentials to be harvested.

Su's warning was not included in Cointelegraph's July coverage but has gained significance since.

Su had also anticipated why security software might miss such a trap. He said each step, such as pulling a code repository from GitHub, looks legitimate on its own, so antivirus tools may not flag it. Binance's investigation later described a similar failure, saying the assignment's setup ran malware that evaded endpoint tools through obfuscation. Su said the onus is on Binance to detect such attacks and stop the code from executing.

What to watch: Binance says independent cybersecurity experts are reviewing the incident, with some technical details and security measures to stay confidential.

Read the full story on Cointelegraph →