A reported fake recruitment process linked to the Binance incident involved a malicious coding assignment downloaded to an employee’s work computer. If a recruiter contacts you, verify the opening through the employer’s own careers page, check the recruiter’s identity, and keep unfamiliar files off work devices.
How the reported Binance approach unfolded
Binance’s account describes an engineer being contacted through a legitimate job-hunting platform by someone posing as a project director for a fictitious company. Purported HR staff and a supposed CEO then conducted separate interviews. In the first, the interviewer held a live video call and shared a personal social-media account. In the second, held through a social chat app, the engineer was asked to download a coding assignment containing malicious code to a work computer, according to CNBC’s account of the incident.
Binance said attackers used stolen credentials to reach an internal service involved in authorizing wallet transactions during an October 29, 2026 incident that affected about $6.34 billion in digital assets. The fake recruitment approach was one reported part of the attack pathway.
Warning signs to check during recruiter contact
Former recruiter Stefanie Fackrell recommends looking closely at a recruiter’s profile. An uncanny-looking photo, very little activity, few connections, or missing identity, workplace, and school verification can prompt further checks. A senior executive appearing unusually early in the process may also be worth questioning, unless the role would report directly to that person.
Fackrell also considers a recruiter sharing personal social-media accounts in an early interview unusual. Privacy and cybersecurity expert Leeza Garber says odd delays, unanswered questions, or glitches during a video call can be reasons to pause. These are warning signs to investigate, not proof on their own. Both experts’ guidance was reported by CNBC.
Before you trust the person offering the job, confirm that the opening exists on the employer’s own careers page.
Checks before you respond or download an assignment
Use this sequence when a recruiter contacts you or sends an assignment:
- Find the opening on the employer’s official careers page. Match the job title and company before sharing information or continuing the process.
- Check the recruiter’s profile and identity. Look at the profile’s history and verification details, and assess whether the interview timing and participants make sense for the role.
- Pause if the interview shifts to an unusual channel. A social chat app, unexpected personal social-media sharing, or evasive answers deserves extra scrutiny. One unusual detail alone does not settle the question.
- Keep interviews and assignments off your work computer. Use a personal device, and do not install unfamiliar software or download a coding task until you have checked it with the employer. Fackrell recommends receiving assignments through a legitimate system such as email rather than a phone chat app.
- Do not pay to get a job or hand over sensitive information as a condition of getting one. CNBC’s summary of Federal Trade Commission guidance says applicants should not have to pay or provide sensitive information to obtain a job.
You have completed the basic checks when the opening matches the employer’s careers page, you can verify who is contacting you, and you know how any assignment will be delivered before opening files. If a request involves money, sensitive information, or an unfamiliar download, pause and contact the employer through its official channel.
