November 1, 2026 - 9 min read

By PhishClean Research Team

The fake job interview that empties crypto exchanges

A recruiter, a take-home test, one laptop with too much access. How North Korea's favourite way into crypto companies works, and how to run a coding test without handing over your machine.

On 29 October 2026, attackers drained Binance's hot wallets across several blockchains in a few hours. Estimates put the theft at about $6.3 billion, the largest crypto heist on record, and roughly $3 billion has since been frozen. Binance's first findings point to a compromised engineer's laptop that was used to push unauthorized withdrawals. TRM Labs and Chainalysis attribute the theft to TraderTraitor, a North Korean group that is part of the wider Lazarus cluster.

How that laptop was compromised has not been published. Binance has promised a post-mortem. But analysts have a leading guess, because this group has done it before: a fake job offer, a "technical assessment", and an engineer who ran the attacker's code on a work machine.

What we know, and what is still a guess

Why the fake recruiter is the leading guess

Because it has worked on crypto companies again and again:

• DMM Bitcoin, 2024 ($308 million). The FBI says a TraderTraitor operator posing as a LinkedIn recruiter sent an employee of Ginco, DMM's wallet software provider, a Python script disguised as a pre-employment test. The employee ran it. The attackers later used stolen session cookies to tamper with real transactions.
• Bybit, 2025 ($1.5 billion). Safe{Wallet} says a developer's Mac was compromised after they downloaded a Docker project, most likely through a social-engineering lure. The attackers used that machine to reach Safe's cloud account and altered the wallet interface Bybit's signers relied on.
• Contagious Interview. Security researchers have tracked a long-running North Korean campaign under this name since at least 2023, built entirely on fake interviews with developers.

The pattern is always the same: trick one developer, then quietly use the access that developer already has.

How the fake interview works

1. The approach. A recruiter or "founder" messages you on LinkedIn, Telegram, X or email. The role is senior, remote and well paid, often at a crypto, Web3 or fintech company. The profile looks real; some are hijacked accounts of real people.
2. The friendly part. A short chat or call. Everything feels normal, and that is the point.
3. The technical step. This is where you get infected, through one of three doors described below.
4. The payload. The malware steals browser passwords and cookies, crypto wallet extensions, SSH keys, cloud credentials and the macOS keychain, and usually installs a backdoor.
5. The real attack. Days or weeks later, the attackers use your logins, sessions and keys to reach your employer's systems.

Door 1: the take-home repo

You are sent a GitHub, GitLab or Bitbucket repo: "clone it, run it, fix the bug on the wallet page". It is a real-looking app with one extra piece that runs the moment you install or open it. The tricks researchers keep finding:

• npm install hooks. preinstall, postinstall and prepare scripts run by themselves during npm install. You never type the command that infects you.
• VS Code tasks that run when you open the folder. A .vscode/tasks.json task with "runOn": "folderOpen" starts as soon as you click "Yes, I trust the authors". In one sample the Security Alliance analysed, the hidden task was named eslint-check and ran node public/font/fa-brands-regular.woff2: a JavaScript file disguised as a font.
• Code that downloads code. A route or config file calls the attacker's server, then runs the reply. One sample had the server answer with an error on purpose and fed the error body to new (Function.constructor)("require", ...), which runs it with full access to your machine.
• Code you can't see. The payload sits on the same line as a harmless config object, pushed hundreds of spaces to the right so it never shows up on screen. Or it is run through an obfuscator.

// .vscode/tasks.json — runs the moment the folder opens
{ "label": "eslint-check", "type": "shell",
  "command": "node public/font/fa-brands-regular.woff2",
  "runOptions": { "runOn": "folderOpen" } }

Door 2: the video interview that "fixes your camera"

Sekoia named this variant ClickFake Interview. You are invited to record answers on a professional-looking interview site. When you click "enable camera", it reports a camera or driver error and gives you the fix: open Terminal on a Mac, or press Windows + R or open PowerShell on Windows, and paste a command it has already copied for you. The command downloads and runs the malware.

It is the job-seeker version of the fake CAPTCHA that tells you to press Win+R. No real interview platform ever asks you to run a command. Sekoia found invitations for business development, asset management and product roles too, not only engineering.

A close cousin: "to join the interview, download our meeting client" or "your Zoom SDK is out of date", with an installer served from a lookalike domain.

Door 3: a trojanized tool you already use

The newest example is aimed squarely at DevOps engineers. On 8 October 2026, three weeks before the Binance theft, Zscaler ThreatLabz described a campaign that hid malware inside a fake Terraform provider called terraform-provider-awsbeta. It still worked as a provider, so nothing looked wrong. In the background it downloaded a script from a lookalike domain, hashicorp-terraform[.]io. The script then fetched an encrypted payload disguised as a .woff font for Linux, macOS or Windows.

The payload, FLATROOF, is a backdoor written in Rust, with Python stealers that take browser logins and cookies, the macOS keychain, Windows Credential Manager entries and wallet extensions such as MetaMask and Phantom. Zscaler links the campaign to the KelpDAO incident and to TraderTraitor's tactics. It is careful to say it has not found the code or infrastructure overlap needed for a high-confidence attribution. How the fake provider reached its victims is unknown.

Does the programming language matter?

Not much. The group's tools have moved over time:

Rust and Go produce a single program for every operating system, and antivirus tools are still a little weaker at analysing them. But the language isn't what made any of these attacks work. The malware only opened the door. In Binance's case, the theft itself reportedly went through the company's own internal systems and a legitimate Ethereum feature, EIP-7702.

The real weak point: one laptop, too much access

Two things had to be true for this to work: one person ran a file they shouldn't have, and that one machine could reach systems that move money. The first will always happen eventually. The second is a design choice. For companies:

• Keep the machines that can approve withdrawals, sign transactions or reach production away from everyday development. No browsing, no take-home tests, no unknown repos on them.
• Require hardware security keys and short-lived credentials, so a stolen cookie or token expires before it can be used.
• Require more than one person, on separate devices, to approve large movements, and show signers what they are really signing.
• Tell engineers outright that this attack exists, and that being approached by a recruiter is not something to hide from the security team.

Red flags in a job offer

• The process jumps straight to "download this repo and run it", or skips the normal interviews.
• You are asked to fix a bug in an app that handles wallets, tokens or trading, against a deadline.
• The conversation moves to Telegram, WhatsApp or Discord.
• The interview site wants you to run a command, install a driver or download a special meeting app.
• The repo is brand new, has no history, and its owner account is days old.
• The pay is well above the market for very little process.

Our free coding test checker also has a tab for pasting the recruiter's message.

How to do a take-home test safely

1. Read before you run. Open package.json (look at scripts) and the .vscode folder on the website first. Check what any file a script runs actually contains, especially if it is named like a font or an image.
2. Run it somewhere disposable. A throwaway virtual machine or a cloud dev environment such as GitHub Codespaces. Never the laptop with your password manager, wallets, SSH keys or work VPN.
3. Open it in Restricted Mode. When VS Code asks whether you trust the authors, click No. Tasks, debuggers and workspace extensions stay off.
4. Install without scripts. npm install --ignore-scripts stops the install hooks. It does not make running the app itself safe.
5. Check the repo first. Paste it into the coding test checker. It reads the install hooks, VS Code tasks and server and config files without running anything.

A real employer won't mind you running their test in a sandbox. One that pushes back or rushes you has told you what you need to know.

Already ran it? Do this now

1. Disconnect the computer from the internet. Don't log into anything else on it.
2. If it is a work machine, tell your security team immediately. These attacks are after the access your job gives you, and minutes matter.
3. From a different, clean device, change your email and password-manager passwords first, then everything saved in the browser on the infected machine. Sign out all other sessions.
4. Move crypto to a new wallet created on a clean device. Assume any seed phrase or wallet extension on the infected machine is known to the attacker.
5. Revoke and rotate SSH keys, GitHub and npm tokens, cloud access keys, API keys and anything in .env files on that machine.
6. Wipe and reinstall the operating system. Backdoors like FLATROOF set themselves up to survive a reboot, so a scan is not enough.
7. Report the recruiter profile and the repo to the platforms, and keep the messages in case your employer or the police ask.

What PhishClean does about it

A browser extension can't stop code once it runs on your computer. It can catch the steps that come before, which all happen in the browser. PhishClean 1.9.0, now live on Chrome and Firefox as part of 1.10.0, adds:

• A warning on fake interview "camera fixes": an interview or meeting page that says your camera or microphone is broken and tells you to paste a command into Terminal, PowerShell or the Run box. Free for everyone, like the fake CAPTCHA check.
• A coding-test repo check on GitHub, GitLab and Bitbucket. When you open a repo, PhishClean reads its install hooks, VS Code tasks and server and config files, and shows a card if installing or opening it would run hidden code. The files are fetched from the code host in your tab and nothing about the repo is sent to us.
• A warning on fake meeting-app downloads: "download our client to join the interview" from a site Zoom, Microsoft or Google do not own.
• Lookalike checks for the brands these lures copy, including Terraform, HashiCorp, Calendly, GitLab, npm, Bybit, KuCoin and Trezor.

The repo check and the meeting-app warning are part of the paid checks, and they run during the 7-day free trial. You don't need the extension for the coding test checker; it works in any browser today.

Frequently asked questions

Was the Binance hack caused by a fake job interview?

Not confirmed. Binance's first findings point to a compromised engineer's laptop, and analysts attribute the theft to TraderTraitor. How the laptop was compromised hasn't been published. A fake job offer or coding test is the leading guess because the same group used one against DMM Bitcoin.

Is it safe to run a take-home coding test?

Only in a sandbox: a throwaway virtual machine or a cloud dev environment, opened in VS Code's Restricted Mode, installed with --ignore-scripts. Never on a machine with your passwords, wallets or work access.

What does this malware steal?

Saved browser passwords and cookies, crypto wallet extensions, SSH keys, cloud and API credentials, the macOS keychain, and anything else that gives access. Then the attackers use that access to reach company systems.

Sources

• Wikipedia: 2026 Binance hack (timeline, totals, attribution)
• Engadget: Binance hacked for an estimated $6.3 billion
• Hackread: Binance probes DevOps engineer's hacked laptop
• Zscaler ThreatLabz: Suspected TraderTraitor group uses trojanized Terraform provider
• Security Alliance: VS Code tasks abuse by Contagious Interview
• GitLab: How to detect and prevent Contagious Interview IDE attacks
• Cyber Press: ClickFake Interview uses the ClickFix technique (summarising Sekoia)
• The Hacker News: FBI ties the $308M DMM Bitcoin theft to TraderTraitor
• The Block: Safe developer machine compromised before the Bybit hack

Last updated: 2 November 2026