The Binance heist began as a job interview

The largest crypto theft on record started with a recruitment process. Chainalysis, summarising the initial findings Binance released on Tuesday, says the attack began in September when an engineer received an invitation through a legitimate job platform. After two rounds of interviews with a fictitious company, the employee was asked to download an interview assignment that contained malicious code, which gave the attackers their first foothold inside the exchange.

Chainalysis's contribution is the history. Over the past 18 months it has attributed more than $14.3 million in losses to similar fake-interview and malware schemes linked to North Korea, against targets ranging from individual holders and private wallets to protocols and DAOs. Its senior intelligence analyst Tom McLouth says the team has identified dozens of other interview compromises that led to wallet thefts, and that across them the attackers were perfecting their method on small targets. In his words, that is how you end up with the biggest heist in history.

The firm describes what those earlier cases looked like. In several, victims had wallet keys stolen from cloud storage after a malicious interview, and some said their seed phrases had never been on the infected device, which suggests the access reached compromised cloud credentials or browser sessions. That fits Microsoft's reporting that North Korean malware searches for seed phrases and password-manager data.

The infrastructure is evolving too. Chainalysis reports a fivefold surge over the past year in what it calls blockchain dead drops: malware instructions hidden in public blockchain transactions so infected machines can always find their command server. One technique spreads pointers across TRON and Aptos that lead to a payload stored on BNB Smart Chain; another encodes the instruction in an address nobody controls. The Binance figure here is Chainalysis's; other estimates of the theft differ slightly.