DPRK Hackers Perfected Their Fake Interview Playbook Over Dozens of Attacks Before Binance

What it is

A Chainalysis post, written after Binance's initial findings were released, on how DPRK fake-interview ("contagious interview") attacks led to the Binance theft. Chainalysis gives the loss as $6.4 billion, while its own summary bullets say $6 billion. The post offers no indicators, detection queries or named malware families.

How it works

Binance's account, as relayed by Chainalysis: in September an engineer was approached through a legitimate job platform. Attackers spent weeks building trust and ran two interview rounds under a fictitious company. The engineer was then asked to download an interview assignment containing malicious code. That gave the initial foothold, after which the attackers deployed malware and used access to an internal AI tool to move deeper.

Chainalysis says victims in other cases lost wallet private keys held in cloud storage. Some reported that the seed phrases were never downloaded to the infected device. Chainalysis suggests the access went beyond local files, possibly through compromised cloud credentials or browser sessions. It cites Microsoft reporting that DPRK malware searches for seed phrases and password-manager artifacts.

The C2 technique, which Chainalysis calls a Blockchain Dead Drop (also "EtherHiding"), has been used since early 2025 in these schemes. Pointers on TRON and Aptos lead to a BSC transaction that holds the payload.

flowchart LR
    A[Infected machine] --> B{Query TRON pointer}
    B -- works --> D[BSC transaction: payload]
    B -- fails --> C[Query Aptos pointer]
    C --> D

Preconditions / Affected

The targets are employees with privileged access to sensitive infrastructure, in the post's words. Past victims include individual holders, private wallets, organizations, protocols and DAOs. The post attributes over $14.3 million in losses to these schemes over 18 months. Chainalysis analyst Tom McLouth says the earlier compromises ranged from tens of thousands of dollars to millions, and that they let the attackers refine their method. That is Chainalysis's interpretation, not a demonstrated link.

What to do

The post gives no technical controls. Its only guidance is to look beyond conventional cybersecurity controls to the financial infrastructure behind these operations, and to combine blockchain analysis with threat intelligence to trace and freeze funds. The facts above support a few checks, though the post does not list them: treat interview "assignments" as untrusted code, and look for seed phrases or keys reachable through cloud storage and browser sessions on developer machines.

Caveats

• The Binance investigation was still ongoing at publication, and Chainalysis expected the stolen funds to keep moving.
• Chainalysis claims a fivefold rise in blockchain-assisted attacks over the past year. It ties this partly to the "potential use" of open-weight AI models, without evidence in the post.
• The IT-worker section is context only. The UN estimate is over $600 million a year, and workers ask for stablecoin pay and pass it to intermediaries. Those intermediaries include the Russian and DPRK nationals sanctioned by the U.S., according to the post.