Register
Sign in
Menu
.jpg)
.jpg)
A job opportunity can feel like a welcome break in a long search. That is part of what makes fake recruitment so effective: the process can look familiar, professional and personal.
In its November 3 incident update, Binance said a person posing as a project director contacted one of its software engineers through a legitimate job platform. The engineer then took part in two interviews. During the second, the supposed employer asked the engineer to download a coding assignment to a work computer. Binance said the repository contained malicious code that ran during setup.
The interview was one step in a larger attack. Binance also reported a separate software supply-chain compromise earlier in the year. It said attackers later used the compromised device and an internal AI tool to reach other employees and ultimately interfere with wallet operations. The company described the incident as a multistage campaign, rather than a simple phishing message or a single fake interview.
“Job scam” can describe different schemes and knowing which one you are facing helps you respond.
In one common fraud, scammers pose as recruiters offering remote work. The “job” may involve rating products, clicking through tasks or improving a company’s online presence. The supposed employer asks the worker to deposit money, often cryptocurrency, to complete the tasks or unlock higher commissions. The FBI warns that victims may initially be allowed to withdraw small amounts, then face larger deposit demands before their accounts are frozen. A legitimate job should not require you to pay money to earn your wages.
In a more targeted cyberattack, the fake employer tries to gain access to a person’s device or workplace. The request may sound routine for a technical role: install a video app, open a code repository, run an assignment or troubleshoot a connection problem. The risk is that the file or command may install malware or expose credentials.
The FBI has separately warned about North Korean actors targeting IT professionals through fake interview processes. Its November 2026 DOJ announcement described another social-engineering campaign, called FaceStealer, involving deceptive video meetings and malicious prompts. The DOJ described FaceStealer and the Binance theft as separate activities, so they should not be treated as one campaign.
No single detail proves that a recruiter is fraudulent. The risk rises when several warning signs appear together.
A polished profile or live video call is not enough to establish trust. Binance said the purported interviewer used a live video call and a social media account with personal photos and videos as part of the process. That made the approach more convincing, while the later code download created the security risk.
You cannot guarantee that you will never encounter a convincing scam. However, you can make it harder for a fake recruiter to move you from conversation to compromise.
Verify the opportunity through a separate channel. Find the company’s official website yourself and check whether the role appears on its careers page. Contact the company through an address or number listed there. Do not rely on links, phone numbers or contact details supplied by the recruiter.
Keep the hiring process on approved channels. Ask to communicate through the company’s official email and interview platform. A recruiter’s willingness to answer basic questions about the role, reporting structure and hiring process is useful but verify those answers independently.
Treat code assignments like software installations. Do not run code from an unknown repository on your personal computer or work device. Ask the company to provide a controlled assessment environment or a non-executable alternative. If you are already employed, check with your security team before opening or running interview materials on a company device.
Do not install a “fix” during an interview. If someone says your audio or video is broken and sends a link to install a tool, pause. Close the meeting and verify the request with the company through a separate, trusted contact method.
Protect access that could reach valuable systems. Use a password manager and multifactor authentication. Never share a one-time code, password, private key, wallet recovery phrase or developer token with a recruiter. Keep work and personal devices separate when possible and do not approve unexpected login or access requests.
Walk away when the job requires your money. Do not send money to unlock tasks, increase commissions, cover “taxes,” or release earnings. The FBI advises victims of these schemes to stop sending money and report the incident.
Stop interacting with the file or application. If you used a work device, contact your company’s IT or security team promptly through a trusted channel. Use a different, trusted device to change passwords, revoke active sessions and review access tokens if your security team advises you to do so. Preserve the recruiter’s messages, email headers, links and files for investigators.
If money was taken or a recruiter demanded payment, stop sending funds and report the incident to the FBI’s Internet Crime Complaint Center at IC3.gov.
The larger lesson is that recruitment has become part of the attack surface for people and organizations working in digital assets. A fake interview can begin as a personal approach, then create risk for an employer, its customers and the systems an employee can access. For crypto firms, a hiring process that treats every assignment, application and access request as a security decision can help close that gap.
Was Binance hacked through a fake job interview?
Binance said a fake recruitment process was one part of a larger, multistage incident. It also described an earlier software supply-chain compromise and later misuse of internal tools.
Are all crypto job offers scams?
No. However, a job that requires you to deposit money or cryptocurrency to earn wages or commissions is a major warning sign.
Can a live video interview prove that a recruiter is legitimate?
No. A video call can be staged and personal-looking profiles can be used to build trust. Verify the role and recruiter through the company’s official channels.
Should I run a coding assignment on my computer?
Do not run unverified code on a personal or work device. Ask for an approved, isolated environment or another assessment method.
What should I do if I sent money for a fake job?
Stop sending funds, preserve messages and transaction records, contact your financial institution or exchange and file a report at IC3.gov.