The Binance theft method is exactly the same as the 2022 Axie theft case, both starting with fake recruit

Binance disclosed that its October 29 security breach began with a fake recruitment scheme, in which an engineer was contacted on a legitimate job platform by someone posing as a "project director," underwent fake HR and CEO interviews, and was induced to download a "homework" code repository containing a zero-day trojan that bypassed endpoint protection. Attackers then used the compromised device and an internal AI tool to control two other wallet engineers' computers, steal deployment credentials, and run a malicious script that moved roughly $6.3 billion on October 29; Binance says it has frozen or intercepted about $2.85 billion and covered 98% of affected assets. The method mirrors the March 2022 Ronin bridge hack, in which North Korea's Lazarus group approached a Sky Mavis engineer on LinkedIn with a high-paying job, sent a trojan-laden offer file after multiple "interviews," seized validator private keys, and stole about $625 million. Binance also said it has detected and blocked 57 suspected North Korea-linked cyberattacks this year, using tactics including fake interviews, malware disguised as popular developer tools, tampered software packages, and browser plugins. The parallels point to a persistent social-engineering threat targeting crypto exchange and protocol engineers, with attention now on recovery of the remaining assets and on hiring- and endpoint-security controls across the industry.