Before breaking Binance's $6.3 billion, how did North Korean hackers hone their fake job recruitment script across dozen

Binance disclosed that a North Korean hacking group was behind the theft of roughly $6.4 billion in crypto, an attack that began in September when an engineer received a fake job interview invitation. After two interview rounds with a fictitious company, the employee downloaded a malicious coding test that gave attackers an initial foothold, which they used to pivot through internal AI tools into Binance's core systems. Chainalysis said it has attributed over $14.3 million in losses across dozens of smaller North Korea-linked fake-interview and malware scams over the past 18 months, which served as rehearsals for the Binance heist. The attackers also used "Etherhiding" and "blockchain dead drops," writing command-and-control pointers on TRON and Aptos that redirect to a payload on BSC, a tactic that has surged fivefold in a year. The case shows that social engineering, not contract bugs, has become the primary breach vector for large crypto institutions. Watch for wider adoption of endpoint behavior auditing, red-team simulations and on-chain monitoring, plus more disclosure on how the stolen funds are laundered.