Binance hackers used fake job interview to breach PC before $6.3B attack

Commenters describe the fake job interview as a social-engineering tactic that can compromise a developer’s work computer, and some say similar attacks have recently targeted other software communities. They warn against running interview files or unfamiliar executables on an employer’s laptop; one commenter said they sandbox interview work, while another usually declines such interviews as a red flag. Others recommend using containers to isolate repositories and reduce malware risk. The possibility of personal liability also came up: one commenter wondered whether tech workers need insurance, while others noted that a million-dollar policy would barely matter against a multibillion-dollar loss and that contractors in the UK and US commonly carry liability coverage.

The sharper divide is over whether this should be treated mainly as an individual’s security mistake or as a failure of Binance’s controls. Several commenters said a compromised engineer’s device should never provide a path to wallet keys or allow one person to move billions; they criticized direct human access to sensitive resources and advocated tightly restricted, emergency-only access. One commenter speculated that weak transaction-signing controls or a compromised software release could explain the theft, then noted Binance’s account that attackers subverted an EIP-7702 contract instead. Across these views, commenters questioned how an endpoint compromise could enable such a large attack, regardless of whether the employee should have used that computer for an interview.