That dream job offer might be from a North Korean hacker

The crypto exchange Binance revealed that North Korean hackers may have employed fraudulent job interviews as part of their elaborate plan to pilfer $6.3 billion from the platform, according to an announcement made on Tuesday. The incident underscores the hackers' dual strategy of targeting both the job market and the crypto industry.

In September, a software engineer at Binance received a job offer from a seemingly legitimate company, contacted through a reputable job-hunting platform. During the interview process, the hacker presented a convincing social media profile to establish trust with the engineer. However, during the second round, the hacker requested the engineer to download a malicious code repository, which ultimately led to the exposure of the engineer and colleagues to the hackers.

Additionally, another software engineer inadvertently downloaded a tampered Homebrew installation in June to install an AI coding tool, further exposing them to the hackers. Binance's security team detected the installation and mitigated the threat by replacing the device and rotating all credentials. This was not an isolated incident, as Binance has detected and thwarted 57 suspected North Korea-linked cyber incidents in 2026, including fake job interview attempts and compromised software packages.

North Korean hackers have been exploiting the job market for years, posing as recruiters and job applicants to infiltrate companies and steal sensitive information or funds. In the crypto industry, they have increasingly targeted employees by posing as recruiters or posing as potential employees themselves. As hiring managers struggle to find qualified candidates in a competitive job market, job seekers are increasingly anxious about finding new opportunities.

North Korea has capitalized on this situation, with IT worker fraud rising in 2026, with North Korean applicants now making up 1 in every 47 applications, up from 1 in 343 in the previous year.