{
  "id": 18067902,
  "title": "Two interviews and a coding test: How a fake job opened Binance to North Korea",
  "url": "https://urgent.news/2026/11/04/two-interviews-and-a-coding-test-how-a-fake-job-opened-binance-to",
  "topic": "business",
  "section": "Business",
  "published": "2026-11-04T04:01:15.000Z",
  "source": {
    "name": "e27",
    "slug": "e27",
    "url": "https://e27.co/two-interviews-and-a-coding-test-how-a-fake-job-opened-binance-to-north-korea-20261104/"
  },
  "original_language": "en",
  "account": "In the aftermath of North Korea's theft of $6.4 billion from Binance, a new analysis from Chainalysis reveals that the smaller losses, totalling $14.3 million over the past 18 months, may be more significant. These losses stemmed from fake job interview schemes and malware attacks targeting individuals and organizations in the crypto space. Chainalysis analyst Tom McLouth stated that the attackers were refining their methods through multiple rounds of interviews for non-existent companies before gaining access to victims' systems. The final heist, amounting to $6.4 billion, is seen as the culmination of these preparatory attacks. Binance's recent findings confirm that the breach began with a seemingly legitimate job interview invitation that led to the compromise of an engineer's laptop. This technique, dubbed \"contagious interviews,\" targets employees with privileged access, making them more valuable than wealthy crypto holders. The malware was deployed through a malicious interview assignment, providing attackers with a foothold into Binance's systems. Smaller cases also show how malware can compromise cloud logins and seed phrases, highlighting the importance of securing these credentials. The attackers also changed their malware delivery methods, using Blockchain Dead Drops to hide instructions within public blockchain transactions. Additionally, North Korean operatives posing as job applicants are using VPNs and stolen identity documents to gain remote employment worldwide, often receiving salaries in stablecoins. This scheme has generated over $600 million annually for the regime and provides a cover for their malicious activities. The risk is particularly relevant for Southeast Asia, which boasts a large pool of remote tech talent, making it an attractive target for these sophisticated attacks.",
  "summary": "Before North Korea’s hackers took US$6.4 billion from Binance, they took US$14.3 million from people most of us will never hear about. That second figure, from a new Chainalysis analysis, may matter more. Over the past 18 months, the blockchain analytics firm has linked more than US$14.3 million in losses to DPRK-linked fake job interview […] The post Two interviews and a coding test: How a fake…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Business Recorder",
        "title": "North Korea fires unidentified projectile toward sea off its east coast, Seoul",
        "url": "https://urgent.news/2026/11/04/north-korea-fires-unidentified-projectile-toward-sea-off-its-east",
        "published": "2026-11-04T06:24:06.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}