Binance's Security Chief Explained the $6.3B Hack Tactic in July. Then It Happened.

I keep a running note of things security people say in interviews that nobody clips. Back in July, Binance chief security officer Jimmy Su spent part of a conversation explaining how a fake coding assessment can quietly compromise an employee's laptop. On the surface, it sounded like a routine warning, the kind of thing a CSO says because it's on the slide deck.

Then Binance lost $6.3 billion. And the tactic that got used looked a lot like the one he'd described.

That's not a coincidence. That's a warning that got filed under "interesting but not urgent" and then got cashed in.

The mechanics of a fake interview

The one thing to remember from this week: attackers don't break into crypto companies anymore. They get hired by them. Or at least they get far enough into the hiring process to hand you a file.

Here's how it works, because most coverage waves at this and moves on. A recruiter reaches out. Sometimes it's LinkedIn, sometimes Telegram, sometimes a domain that looks close enough to a real one that you don't look twice at 11pm. They've got a role, it pays well, and the first step is a technical assessment.

You get a repo. You get a brief. You're told to clone it, install dependencies, run the tests, submit your solution by Friday.

And then you typenpm installon your work laptop.

That's it. That's the whole attack. A malicious package in the dependency tree runs a postinstall script, pulls down a second stage, and now someone has a foothold on a machine that sits inside your corporate network. For a crypto exchange, that network touches wallets, signing infrastructure, internal dashboards, and the credentials that unlock all of it.

Developers run code from strangers constantly. It's the job. Every library, every boilerplate repo, every Stack Overflow snippet is a small act of trust. Attackers just moved the trust exercise into the interview funnel, where people are eager, distracted, and being judged on how fast they can move.

$6.3 billion is the number attached to the result. Let that sit for a second.

For context, that's more than most mid-cap crypto exchanges are worth entirely. It's roughly the market cap of several top-50 tokens combined. A single successful social engineering chain, started with what amounts to a fake job posting, produced a loss that dwarfs what most security teams spend in a decade.

And Su had already sketched out the shape of it months earlier, in public, for free.

Hiring is the softest door in the building

Pull the camera back and this stops being a Binance story.

Every exchange, every wallet provider, every custody shop, every DeFi protocol with more than $100 million in TVL runs the same hiring pipeline. Recruiters sourcing candidates from public profiles. Take-home assessments sent as zip files. Contractors onboarded in a week with a laptop and a VPN token. The process is optimized for speed and volume, not for whether the person on the other end is a threat actor with a GitHub account.

Here's a question worth asking. How many crypto companies have a written policy that says technical assessments must be run in a sandboxed VM with no corporate credentials attached? My guess is fewer than you'd think. Maybe a dozen out of hundreds.

Why crypto specifically? Because the payoff is instant and irreversible. Bank fraud gets clawed back. A wire transfer gets frozen. A chain transfer settles in seconds and stays settled. Attackers aren't targeting crypto firms because the people are sloppier. They're targeting them because the money doesn't come back.

There's a second-order effect that gets ignored too. Every firm that gets hit this way loosens its hiring process, which makes it slower and more bureaucratic, which makes it harder for actual developers to get jobs. The tax lands on regular people trying to break into the industry. That's the part that bugs me.

And the insurance math is quietly brutal. If a $6.3 billion loss traces back to a fake coding test, underwriters start asking about hiring controls during renewal. Premiums move. Coverage shrinks. Smaller exchanges get priced out of protection entirely, which makes them the easiest targets, which makes the next headline more likely.

What I'd actually do with this

Three things, in order of how much they matter.

First, treat the assessment as hostile until proven otherwise. Any candidate exercise runs in a disposable VM. No saved credentials. No SSH keys. No access to Slack, email, or internal repos. This is a one-hour policy change and it kills the entire attack class.

Second, verify the recruiter out of band. Not through the same channel that reached out. Call the company switchboard, hit the careers page, message someone who actually works there. Most of these impostors fall apart the moment you leave their channel.

Third, stop treating security awareness training as the answer. Su didn't need to explain the tactic to a room of engineers, he needed the org to have a hard rule that made the tactic useless. Awareness fails under time pressure. Technical controls don't.

Look, here's my honest read. The uncomfortable truth about a $6.3 billion loss is that it probably won't move budgets the way it should. Security still gets treated as a cost center while marketing gets the headcount. Every exchange says the right things for about six weeks after an incident like this, then the roadmap fills up and the sandbox policy slides to next quarter.

The attackers are running a numbers game. They'll send a thousand fake assessments this quarter. They only need one yes. The defenders have to get it right every single time, on every single hire, forever.

That asymmetry is the whole story. Su saw it coming and said so out loud. The industry got the memo and filed it anyway.

That's the week. See you Monday.