North Korean fake job interview led to $6.3B Binance heist
theregister.com
theregister.com
That's a huge red-flag. In a company of this size, the deployments should be via CI only. CI isn't just to increase the speed and reliability of deployments but also to provide a clean room to build the software! Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.
Also, Binance should be paying for intrusion testing. Better to pay a trusted company to do this kind of thing instead of letting North Korea show you how it's done. I don't think this exact exploit path would have been found but I bet the intrusion testing would have figured out another way to use Engineer C's token.
Which is also why we, collectively, as an industry needs to not put up with that. It's easy for me to say from the comfort of it not being my job on the line, that if this happens to anybody they should quit and then name and shame the company, but a competent security team is going to have the idea of doing a fake phishing interview and then not do it because of how morale destroying that would be. The security awareness team sending fake phishing emails are embarrassing enough.
Anyone who fell for it would not only get in trouble for poor security practice, they would reveal that they were job searching. That opens an entire can of worms that creates problems beyond the pentest. This also angers other employees who see it as a double-trap being sprung on employees.
Another major problem is that responsible employees who accept the fake interview but then use their personal laptop to do the interview will have their personal laptop compromised by the pentesters. Responsible testers will immediately abort, but some will try to use the personal laptop to pivot deeper which is a huge ick. It’s also really bad if the company is compromising personal laptops of people who are doing the right thing (switching to personal gear for interviews).
Hired oentest has company permission to do stuff on company property. I do not imagine they have right to do so to personal property.
Game over.
Taking over that first engineer's workstation shouldn't ever have resulted in $6.3B of damages. I would consider it reasonable if those privileges could be abused (by e.g. the same engineer intentionally) to cause $6.3M of damages and the rest would be mitigated or prevented; so for this incident we could say that 0.1% of the impact was caused by the initial compromise of that workstation and 99.9% of the losses were caused by all the other failures - so it's effective for any pentest to focus on the latter part, ignore the social engineering and phishing part (since you can't really eliminate it anyway - unlike many other flaws) and assume initial compromise as a starting point.
If your laptop is successfully compromised by the pentesters then pretty much by definition you weren't being responsible. Though I agree that pentesters going after personal devices is ethically dubious.
> Though I agree that pentesters going after personal devices is ethically dubious.
It's not just ethically dubious. It crosses a lot of legal boundaries. A company can consent to have their personal devices hacked. An employee doesn't automatically consent to let a company's contractors access their personal devices.
For many build chains, that involves implicitly installing software.
That said I wouldn't trust a compiler to be hardened against malicious input and anyway you presumably need to run the output so all of that should be happening in a hardened sandbox regardless.
If you ever meet with Alibaba for any reason they'll ask you to download their conference software. Unfortunately most people in the China ecosystem don't have the guts to say no and will just gleefully install any .exe thrown at them.
One of the first things I did in my last job was shift processes like this off my team's computers, aside from the security ramifications all it takes is one dumb mistake, one up-arrow too many, one didn't-read-the-whole-line, and now you're doing something to production by accident!
It took a couple months to get the pipeline out of their laptop.
Worth it, yes, as we found interesting things in there which explained why they were so reluctant to deploy upgrades.
.. backdoors which enabled the dev to deploy exploits of their own which wouldn't be visible through CI?
Sure, but those meat puppets shouldn't be developers, they should be administrators, using proper procedures.
Separation of powers seems so fundamental yet also so totally ignored these days.
[1] The fact that the needed to sign 50 of these transactions to solve a race condition seems like an implementation detail
The fact nobody thought of this is pretty staggering.
lol that's the worst control I've ever heard.
The point is that at some point you do need to open the door and let the code in.
That unlettered (npi) engineer who downloaded and ran the interview software on his or her machine is what the human weak link here. Let's call them Engineer F. Seems like this person was specifically selected from the dev team.
Twice I scanned the file after downloading it to a sandbox and twice it found malware that would've been installed.
While this is by far the worst case of this happening, I've read at least a half dozen other accounts of recruiting companies attempting to install malware through the same process. I'm not saying the person should have known, but it's scary this is becoming more and more common.
This person definitely should have known. You don't download and run arbitrary binaries outside of a VM. At this point you don't even compile code from an untrusted source. This is the power user equivalent of falling for a phishing email.
Every service provider system should be designed with the assumption that programmers' PCs and smartphones may be compromised.
but enterprises usually prefer the latter, I guess it's more convenient since it bypasses the bureaucratic processes?
Even worse when you have to do stuff like screenshare or coding. I've had candidates share their screen and have obvious proprietary material in open windows. I've seen countless email inboxes and calendars. I've seen candidates do coding exercises using internal IDEs, dev environments and dev tools. I've had them talk – fully unprompted – about internal tech and unreleased projects. And I'm talking about Google, Meta, Amazon, Coinbase, Uber.
At this point I'm convinced that a large chunk of tech interviews are happening just to extract insider info from employees.
It would never occur to me to use an employer's hardware for such a purpose. It seems absurdly lazy, but I know that not everyone's life works like mine, so I would like to understand why this would be a real problem for people.
Also, some people might not have dev environments set up on their personal devices. Heck, a lot of people only use the internet through their smartphone, when they're not at work.
That's a very uncommon mindset and worldview.
For 99% of people, the default would be "I'm going to join this Zoom meeting from the laptop I use all day long to join Zoom meetings, and I'm going to code using the laptop I use all day long to code".
Lots of people have their work tools setup on their work computer, but not on their personal computer. Their personal laptop might be relatively underpowered and struggle to run all the required software efficiently during an interview. The issue becomes even more significant as more of the tools used require an account - you don't want your interview performance to suffer because you're using an unfamiliar tool or service, so you just use the ones you're used to using every day.
> Lots of people have their work tools setup on their work computer, but not on their personal computer...you don't want your interview performance to suffer because you're using an unfamiliar tool or service...
I struggle to come up of even the most absurd interview scenario where the tool makes the difference especially in our field where if a FOSS tool is not standard, then there's a sufficiently powerful free tier (eg., Sublime, IntelliJ). Heck most remote interviews, they take you out of your tools completely and ask you to code on some shared browser-based editor.
> That's a very uncommon mindset and worldview.
I'm calling HN SV start-up bias. Outside of the startup software eng'g industry, a lot of people exercise very good separation between work tools and personal tools. I know a lawyer, _who's the head of his own law firm,_ bring his personal laptop to the office just so he could purchase tickets during office hours.
I think this is also down to a few factors:
- SWEs are typically issued high-end machines in contrast to other professions whose standard issue is still 4GB (or 8GB, if you're lucky) RAM. For those professions buying a better personal laptop is a low bar to clear.
- SWEs are more efficient when they have admin access to their own machines. Though it begs the question that maybe some inefficiency would've been an acceptable tradeoff to $6.3B.
- SWE is one of the professions on the poster for the "Get paid good while working from Bali" lifestyle, wherein BYOD is implied, especially if you are freelancing.
I had an interview recently where I'd initially planned to use my own machine, then gave up and just used my work computer.
I'm used to the whiteboarding/UML/flowchart software I use at work, so I either needed to pay for a personal subscription so I could use it in the interview or be forced to use some other software I'm not familiar with. I also didn't have a personal paid AI code tool, so again either pay for a personal one or just use the work Claude account. Also the webcam on my work laptop is substantially nicer than my personal laptop.
Also, critically, it doesn't matter. If IT or my manager had pinged me to ask "Did you do an interview at noon yesterday?" I would have said yes and then the only follow-up would have been them asking if it was a random thing or if I was actively looking.
I think IT (and I guess, lawyers) are probably the only people who care much about separating work and personal devices, just because they're prone to being aware of how much surveillance of the device can be happening. People in marketing/sales/whatever back office stuff will be logged into their personal Facebook, Netflix, iMessages, Email and bank and never consider that their keystrokes are being logged and screenshots are being taken.
IT is aware of surveillance. Lawyers have a legal responsibility to take all reasonable steps to safeguard confidential client information. A lawyer misusing a work device is probably roughly equivalent to a healthcare worker doing the same.
Sharing other's company secrets by mistake, using other company's resources in ways that are definitely forbidden - is this a person you really want to hire since they will behave the same in your company? Is this a person you want to give trust with some internals?
In market with 100s or applicants thats enough to disqualify anybody who actually needs an interview or two to get hired.
I've been in management for the past decade and interviewed a few hundred candidates in that time. Never once did I ask or care who owned the laptop they were using.
And similarly, if someone on my team used their work laptop for an interview, I wouldn't care at all.
It reminds them that while I am a replaceable cog in their machine, I am also a cog that other machines would like to install given the right opportunity. And I am always aware of my current market value.
they're not interested, they view it as a work tool and they always have one as they avoid gaps in their resume
no different than say, a work badge. you can buy an NFC enabled badge from ebay but you never will
and you don't need all of that to do anything the professional world wants or requires
And if you are coding full time, it is better to not do coding in your free time if you want to maximize learning anyway.
I know the last time I left my job I was given the opportunity to buy an M1 mac with 16Gb of RAM for €100, so of course I did.
(Though I also paid €500 to keep the phone they'd bought for me, which was perhaps not such a good deal, it was convienent and I do like the phone, but I'd have been happy to have a random cheap android phone, I have no specific requirements beyond "small enough to fit inside a sporran"!)
No chance you can do that on "sick days", fake doctor/dentist appointments, or other such scheming. Taking many half days of personal leave just isn't workable either. You're not in full control of the scheduling to make different companies interview you one after each other on the same day, or take the same time between rounds. Some could have been scheduled in lunch breaks but not all of it.
Most people I've worked with would just schedule some "focus time" and were either WFH or headed off to a quiet part of the office or a nearby co-working space. Personal laptops are easier to use offsite obviously.
For the ones I usually take, a few hours out from overtime budget is enough, or WFH days.
With 30 days holidays + overtime budget, taking a day off for an site interview, is manageable.
Why it isn't? A genuine question, I presume this is more typical US culture or dare I say workaholism and various self-pressures to maintain some public office image?
I recently took quite a few half days off to manage workers doing bigger reconstruction in our apartment. Sometimes full day. Then smashed a week of vacation in Sardinia in between. Everybody understood whats happening, nobody cared since many went through similar exercise before.
Your time is your time, if you actually let it happen. Or you can spend your life living with servile attitude, nobody will thank you though.
Because my personal leave is time I want to spend with my family. I would have had to have taken about 4 days worth of leave (8 half days) to cover these interviews and that's 4 days a year less I get to spend with my wife and kids.
(UK based so not US culture, and not workaholism or image.)
Programmers don't have any self-respect.
Because those half-days soon add up, in this market you don't apply just to one company.
I have a relative who started (what has become) a successful winery.
During the first few years he worked on the winery on nights/weekends, but he kept his day-job as a finance guy at a relatively large company.
He told me he had to give a presentation at the company one day, plugged his laptop into the conference room projector and up popped a spreadsheet of wine-making measurements (pH, temperature, % alcohol, etc.). He said everyone in the room laughed.
I get enough calls asking what security appliances we use, most are probably sales, but heck no should you answer this... It's obvious many people do though.
The company was a bit salty about this as laptops are more expensive, but they got them. And of course the company befitted, as that was the end of a clear separation between work and home. You have your laptop, you can answer email and attend meetings with people in other time zones. Before, it was easy; work stuff stayed on work computers and those didn't leave the office when you went home.
At several companies I’ve seen folks run torrents to watch movies at work.
Once I was on a Zoom call, and I noticed music production software on my colleagues computer.
When I pointed it out, they responded with something like “ Ohh, my kids make music.”
Neat, I guess.
We are talking about highly educated people who work in software development (i.e. can assumed to have some minimum viable knowledge about computers), and not about the dumbest imaginable users.
That's a bit of charity isn't it? Lot's of people in tech that really not that clever even if they are smart. Also, people in HR aren't as tech savvy.
Do I need to go on?
It wasn’t until my PhD when I took an elective in Argumentation theory that I learned about constructing a good argument. And I only learned about fallacies somewhere on the internet.
* I have a PhD in STEM.
-Darth Vader.
Being able to make React components does not require you to be smarter than the average person.
You also have multiple types of intelligence. I worked with a brilliant intern once. The kid was over 100k in student loan debt and didn’t know the loans can’t get discharged.
They can garnish Social Security if you default on Student Loans.
https://www.cbsnews.com/news/how-much-social-security-garnis...
I’m not going to look it up, but at a certain point you’re judgement proof anyway.
I suspect that many desperately poor can successfully dodge the garnishment.
> dumbest imaginable users.
They are often one and the same.
"Need some new software" = "Download it from some random website"
"Software won't run" = "Turn off AV and get it everything permission"
"Still won't run" = "run as root"
My experience is completely different: many software developers are rather paranoid with respect to security, and have quite a good (though far from expert-level) knowledge about security. It's rather that many software developers are quite hostile to security practices that are mostly "security theater" and obstructs them in doing their work.
The following Reddit post
> https://www.reddit.com/r/NonPoliticalTwitter/comments/1e8do2...
and the top answer
> https://www.reddit.com/r/NonPoliticalTwitter/comments/1e8do2...
describe the mindset that I observe rather well.
No, 'people who work in software development' != 'highly educated people' and those both != 'understand how computers work'.
Plenty of software engineeers (and doctors, lawyers, scientists...) are geniuses in their field but have zero common sense.
It is one thing to do personal things on a work laptop, it is another all together to give your children free reign. Are there no penal measures taken to deter this anymore?
I think Binance needs to start having IT Security like a bank as well.
I have not needed admin credentials for regular development purposes since VB6 (which I was using until 2013). VB6 and ActiveX dlls required read/write access to the registry all the time.
I don't disagree but note that apparently a bank in France, Credit Mutuel (and it's Fortuneo online arm), just got robbed of hundreds of millions of EUR: hackers who have beforehand created accounts on Kraken (a cryptocurrencies exchange) and who then wired millions to different accounts, bought cryptocurrencies, and withdraw the crypto.
But the hack was really stealing hundreds of millions from the bank.
So not even banks are safe now.
I don't know how people are ok using their personal accounts on work-laptops full of spyware.
So despite it being a "company" computer I personally installed the blank SSD and installed Arch on it and did not install any company spyware.
I was perfectly comfortable also having Steam installed so I could entertain myself on the plane on business trips. I knew everything installed and spyware wasn't on the list.
When I work at companies that have MDM set up on my computer, I don't do that.
I have a personal desktop because I grew up with video games and a desktop was always a personal investment. I never had a personal laptop, I cannot justify the cost (not a trivial expense, even if my work title is extremely fancy it does not pay on par), so if I would be traveling I would have to take the only laptop I have with me - the work laptop. Well, I managed to never use it, I don't take it with me, but there is a lot of effort in that.
In such a company I would give employees 2 laptops and 2 phones, one set for work only, one set for personal use only, then I would fire on the spot anyone mixing the usage. That would be a start in a longer journey of protecting the company.
I also refuse to install Intune or similar on my personal hardware. Keep work and personal like oil and water!
Often this is solely fault of employers not paying their workers enough.
> use of an internal AI tool as a springboard. The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.
With the AI craze going on recently I've worked at multiple companies where an internal AI tool was vibecoded and I've always been worried about the security implications.
I even create a 1 man company for my consulting services and I receive ads about how people at my company saved me a spot on an online game.
LinkedIn is partially responsible for their neglect here.
I used to go to parties at Hacker Dojo in the early days of AI. Google wasn't into AI yet and Hacker Dojo had classes, often attended by Google people. (I learned way too much about support vector machines, in a class taught by a guy from BlackRock.) There were a lot of very good looking Chinese women at the parties who were very interested in what people were working on. They were very bright, understood the subject, and had business cards from small companies no one had heard of. Then one day they all disappeared and were not seen again. I regret not asking one how she liked working for the Third Department.
They tried to get me to git clone a repo, presumably to get me to install malicious npm dependencies.
I refused, then they wanted me to download Claude Code but I told them I already had Claude Code harness installed on my machine... But they said I should install a different version of it; they sent me a link... The landing page was the same kind of design as Anthropic uses but I didn't recognise the URL. I stopped the interview right there.
The name on the CV, was, for the sake of privacy, Michael Smith, from Australia, and ticked the right boxes.
We'd expect a fluent, Aussie-accented English speaker. Instead, we had a candidate with a webcam that wouldn't work (weird!!), with clearly accented English of a East-Asian background. I suppose there's a vanishing chance they really were Mike Smith of Adelaide or wherever, but we couldn't take that chance. We tried rescheduling, but tumbleweeds...
[0] https://www.binance.com/en/blog/community/322915344375956676...
https://news.ycombinator.com/item?id=50353818 https://news.ycombinator.com/item?id=50357080
That is a huge red flag, and reflects on binance internal security. I would be wary of dealing with this company,
https://www.justice.gov/opa/pr/arizona-woman-sentenced-17m-i...
Yes of course they didn't. The whole "endpoint security" industry is a scam. They're attempting to (or attempting to appear to) solve an impossible problem. All they do is install spyware and backdoors, reducing security rather than enhancing it.
Some companies require you to install Windows remote administration tools (basically root kits) on your machine to check whether you are using search engines or AI. It is insane.
They did, in their sentence "the incident report said".
In one of these many calls I got to see the face from the other side but lasted a few seconds only. Then he claimed that internet was bad and suggested we continued without video.
In this case they claim it was a 2 rounds interview with video turned on to simulate a more normal recruiting process.
Of course all of us are prone to get caught with the shield off but what surprises me is that the targeted dev took the challenge in the device from work.
They have a massive incentive to invent a story to cover up the incident. I'm not saying it's a cover-up, but the motive is definitely there.
North Korea has denied responsibility, whereas they usually own up to their actions.
Disregarding that, it just doesn't make sense for their internal security to be so lax.
I've worked at big companies but with AUM lower than Binance, a lot of control and safeguards are in place to prevent one "rogue" employee from stealing everything.
It's pretty much impossible for a company like Binance to not have implemented such things. I do not buy it.
Google any of these names: Sam Bankman-Fried, Jordan Belfort, Elizabeth Holmes, Kenneth Lay, Bernie Madoff or Jeffrey Skilling.
Man, you're going to have fun reading about what they did!
Another important note is that Binance has a strong incentive to cover up certain details, given that the company itself is anything but transparent. They also control CoinMarketCap, where they promote only projects that serve their own interests, while rejecting legitimate projects due to Binance's conflicts of interest. Several public reports and data document these practices.
Dont trust anything anymore.
This is what crypto is all about: decentralized tokens that require central management and control to be useful and prevent fraud.
The biggest irony is that we get at least a couple of signups every month from South Korea, Russia, India, Nigeria just to try getting access to our platform for running these attacks ..
Here is the most recent copy paste from a Calendly invite ..
>Invitee Email: >ashley@cairnsovereign.net
>Invitee Time Zone: >Central European Time
>Questions:
>Please share anything that will help prepare for our meeting.
>We are an MSP from the UK that is look for a deepfake platform to run campaigns for our clients. We typically use open source software but there is a gap in our portfolio for deepfake testing that we can't fill with our usual open source philosophy.
The company website https://www.cairnsovereign.net/ was registered just 2 days ago .. they have no linkedin presence, fake CEO and fake CTO and fake everything ..
I still accepted the invite and joined and the person has a strong northern british accent .. he askd me to let his AI bot join the call to take notes ... i refused .. to which he swore and said that if a meeting bot is not allowed .. then i dont want to talk and abruptly hung up ...
PS: if anyone wants to see .. this is what a real time voice impersonation call and real time deepfake faceswap .. looks like ..
https://www.bbc.com/audio/series/w27vqd03
(It's also on Spotify, Apple Podcasts etc)
A very recent one wanted me to download an executable which was to "stop me from cheating with AI", which was clearly fake. I've had plenty of interviews where I was expected to clone, fix, and run a repo, which as far as I can tell, all were from legitimate companies. An illegitimate company could easy do the same process with malware.
Binance bugs us all the time to confirm everything before making a $5 payment. Why don't they enforce higher security steps in their own wallets? Also, how can AI access Google Authenticator?
But this is simply bad professional writing. It would be like calling a group of people Japs, Ruskies, Pakis, or Chinamen. Even if we assume less derogatory intent, you probably wouldn't use Yank, Pommy, or Desi in this context either.
I hope that Binance understands this and spends less time worrying about how the laptop was compromised and more time securing their systems under the very basic assumption that laptops will be compromised.
>> trace and freeze the assets
It has gotten to the point where the advertised permanence of cryptocoin transactions is a serous national security threat, literally funneling $6+billion to a nation-state whose publicly avowed statements is to destroy the US to fund its nuclear weapons program.
The party is ending. The house lights are flashing. Crypto will either become controlled so illegitimate transactions will be roll-back-able (presumably with proper court or NatSec orders), or it will be banned.
I expect this trend will continue to the point where the original feature of transactions absolutely untouchable or un-blockable by the state will be gone with the exception of trivial deep underground cryptochains.
And now you get results like this.
No AI, no leet code, just old fashioned gauging someone's experience and communication skills.
Had one recently that waived me thru and then sent me straight to talking to senior management/stakeholders/etc but literally no one on the team itself.
Couldn’t get a straight answer as to what team does, what role is for, real day to day I’d be walking.
Only clear thing was scale of architectural mess stemming from a political mess… and not a lot of interest in changing it.
They wanted a seasoned tech body to throw into the grinder 12-15hr days to replace the last one. No thanks.
Them: "Do you know TCP/IP?". Me: "Yes". Them: "you're hired"
Job at the Westinghouse instrumenting nuclear power plants. Simpler times then.
“What does ifconfig do? What does it mean to mount a disk? What editor do you use? You’re hired.”
None of that culture fit nonsense.
I'd also love a deep dive into the keyboard microcontroller that ends with the key press leaving over USB , and never even considers the main CPU.
Honestly, even the facetious answers to this have the potential to be incredibly interesting. Reality just has a ton of depth.
You already have a degree from some university, and you already worked in software development for quite some time. So it's very annoying to do some test over and over again for every job application.
Yep. Now substitute doctors/lawyers/accountants/civil engineers into the equation and see how you feel about it.
Surely they don't take a test for every client, but I'd consider the interview process more like a "workaround" for the lack of standardized tests for software engineers instead of the lack of respect.
Maybe IT professionals should be held to the same rigour. There’s a lot of deadweight in the profession that get paid too much and moan too loudly despite having a cushty job in a field they’re barely competent in.
Ok, but there's no uniform grading in school or employment. We all know people who managed to get through university without learning anything and manage to hold a job in software development without knowing or doing anything. It'd be nice if a degree and a job history guaranteed competence, but it doesn't.
Lots of professions can bring a portfolio and/or a sample of their work, but most software developers can't because the work is often propriatary and a trade secret, and anyway would need a lot of specific setup to operate.
I've only taken test tests for government jobs, and they were laughably outdated; approximately nobody knew how much space was on a 5 1/4" floppy in 1998 when I took the test, but they were asking about 8" floppies, and I assume they still are, because the test had to go through some process and doing a new test would be expensive. But yeah, I expect a company to validate that I can both describe solutions to problems and turn that description into code.
At worst it’s the biggest hardos on the team writing a bunch of brain teasers and gotchas as a hazing ritual.
An hour to implement a toy version of a component which, the last time I did it "in real life" blew everyone away that I had a prototype ready in 1 day. That real life prototype went through weeks and weeks of iteration before it was even useful, and everyone was happy with that. But yeah that's something to time box to 1 hour in an interview environment.
So turns into an exercise of - which of the 100 pitfalls/nuances do they want me to pretend don't exist in order to complete it in 1 hour. Opinions vary!
There were multiple questions of this form.
One could pass this test blindly as a new grad not knowing the 100 pitfalls of actually building one in real life.
Also in the mid 90s, you actually had to be smart to work in this field. There was no stack overflow or reddit to search. And CS programs were nascent.
Companies certainly have taken it too far, but I don't blame them for some usage of standard tests.
If you cannot explain why a successful candidate was chosen without bias, then you shouldn’t be interviewing candidates to begin with.
But it is always worth keeping a copy of your interview notes just in case the candidate asks for feedback.
By 'test' you mean a school-type paper exam, questions and answers? (On unspecified topics.)
Why would you refuse that, when applying to a job?
Not the OP, but from a certain point on (I'd say 3-5 years into one's career, I'd say maybe even earlier) school-type tests become quite ridiculous, as in real-life programming/development has nothing to do with how people are graded in school.
If by "nothing to do with" you mean "uncorrelated", then this is very trivial and empirically untrue. There are a lot of tests that correlate with peer and manager-rated performance in software development (and many other roles).
Even the dumbest most ad hoc unrelated tests will have nonzero correlations, and the well-studied principled ones much more so.
The better argument is that tests are high effort and can feel demeaning. But it's not productive to pretend they don't work.
I remember doing 6 hours of interviews once for a company, getting to the final stage and they wouldn't budge on $5,000 for a figure they initially accepted but reneged because the manager hiring me would be paid less than me. It was so petty. I turned it down back then, but I'm not sure I would in this market. I'd probably take it and job search while I'm working there like this guy did at Binance.
https://isc.sans.edu/diary/32942
It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?
And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.
Somehow I really doubt it.
I mean: if you even consider leaving your current company, you better leave no traces of your plan on your work laptop: you either use a private laptop or, even better, some burner laptop/computer that you reset afterwards.
Even if you don’t understand the security concerns of running some 3rd party’s scripts on a work device, more pedestrian situational awareness should have prevented such a wild misjudgment?
What the fuck? On a target as big as Binance? Every developer should be treated as a liability and never be able to deploy by themselves.
I wouldn't be surprised if the guys they compromised were high-level staff engineers with the keys to the kingdom so to speak so they found a loophole. Security is hard because the attack only needs one chance to get it right -- and defense needs to get it right every single time.
"TRM attributes this attack to TraderTraitor, North Korea’s premier hacking unit. We base this assessment on robust on and off-chain intelligence sources. The FBI named the same group as responsible for the USD 1.5 billion Bybit hack in February 2025. Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst. The laundering observed so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed Bybit. TRM will share further findings as the investigation develops."
https://www.trmlabs.com/resources/blog/north-korea-steals-us...
This is simply an assertion that an official enemy did something we don't like. It could just as well be a CIA money laundering scheme. This would make more sense, given the wider deployment of US cyber weapons and assets as well as the desire of North Korea not to provoke American aggression which previously murdered about 20% of their population.
It is widely known America has cyberweapons deployed around the globe. It is likely trivial for them to fake a trail of evidence from the DPRK.
Both candidate and recruiter have to call Kim Jong Un a big fat tosser (other swearwords are available) on a recorded video before the interview continues.
I mean it would make sense to hire these NK guys to consult DevSec teams if it wasn't for the travel restrictions in NK -- sort of like how reformed black-hat hackers get legit jobs in the IT sec industry.
There are tools available to stop AI screen recording tools, fake candidate tools yet many companies keep getting hit..
Unfortunately:
1) The dev downloaded it onto a work laptop which was really poor behaviour
2) It sounds like the developer environment was very open instead of segmented. Common but an easy control to use in a high-risk environment.
3) Sounds like a lack of any elevation process e.g. if a developer needed to access a wallet, it very much should sound an alarm/require explicit permission etc.
But it is easy to be wise in hindsight.
On the other end, when doing interviews I suspect 40-50% of candidates use AI assistant tools (might be skewed in tech).
I do miss seeing someone's camera feed break or AI tool break down mid interview.