$6.3B North Korea LinkedIn recruiter scam

A LinkedIn recruiter scam run by North Korean hackers gave attackers the foothold they used to steal about $6.3 billion from crypto exchange Binance on October 29, 2026. A fake "Project Director" put a Binance engineer through two rounds of fake job interviews, then had him download a coding assignment loaded with custom malware onto his work computer.

The FBI attributed the theft to TraderTraitor, the North Korean state-sponsored group also tracked as Lazarus Group. It is the largest crypto theft on record. And it started with something every recruiter and every candidate does every week: a job interview.

I've spent 30 years building recruiting technology. This is the first time I've watched the hiring process itself become a multi-billion-dollar attack vector. Here's what happened, why it worked, and what job seekers and TA leaders should change this week.

In this post:

• How the LinkedIn recruiter scam against Binance worked
• Why a fake job interview scam works so well
• How to know if a job interview is fake
• Job seekers: here is what you should know
• TA and HR leaders: here is what you should know
• The AI governance and compliance lesson
• LinkedIn recruiter scam FAQ

How the LinkedIn Recruiter Scam Against Binance Worked

Binance published its incident report on November 3. Fortune, The Register, Axios and BleepingComputer all walked through it. The attack ran for about five months and had four stages.

June 2026: a poisoned developer tool

A Binance engineer clicked an internet ad for a tampered version of Homebrew, a popular developer package manager, instead of installing it through company channels. Binance's security team caught it, replaced the device and rotated credentials.

Too late. The attackers had already learned who worked on Binance's wallet infrastructure. They had an org chart. They knew exactly who to target next.

September 2026: the fake recruiter

A second Binance software engineer was contacted through what the report calls "a legitimate job-hunting platform." Fortune and others identify it as LinkedIn. His profile listed his Binance experience. That's all the attackers needed.

Someone posing as a Project Director at a company that didn't exist set up a first-round interview with an HR representative. On a live video call, that fake HR rep shared a social media account full of personal photos and videos to build trust. Binance called it "more advanced and deceptive than previously seen social engineering approaches."

The coding assignment

Round two was with the fictitious company's "CEO," held on a popular chat app. Near the end, the CEO asked the engineer to download an interview assignment from a code repository.

He ran it on his work computer. According to BleepingComputer, the repository installed previously unseen custom malware that the antivirus software didn't detect.

October 20 to October 29: inside the network

By October 20, the attackers had used that laptop, plus one of Binance's own internal AI tools, to compromise two more engineers on the wallet team. They took credentials and a container deployment token.

On October 29 they used those credentials to run a malicious script against Binance's wallet signing service and moved billions in crypto across multiple blockchains. As of November 3, Binance said about $2.85 billion had been frozen or intercepted.

Why a Fake Job Interview Scam Works So Well

Read the timeline again as a recruiter. Several rounds. A warm HR rep on video. A take-home assignment. A final conversation with the CEO.

Every step they faked is something we'd call a good candidate experience. The attackers didn't break the hiring process. They copied it, because they knew a candidate would trust it.

And the sourcing was excellent. Seriously. They used the first breach to map the team, then went to LinkedIn and found the exact person with the access they wanted. Any TA leader would recognize that as a targeted search with a clear ideal candidate profile.

Why recruitment scams on LinkedIn keep working

LinkedIn is where professionals advertise their employer, title and skills, on purpose. That's the point of the platform. It's also a target list.

Binance said it had detected and blocked 57 suspected North Korea-linked attempts in 2026 alone, including other fake interviews. Chainalysis has tied more than $14.3 million in losses over the past 18 months to similar fake interview schemes, and says the smaller hits helped North Korean teams refine the playbook before they went after Binance. Security researchers call the campaign "Contagious Interview."

So this isn't one weird story. Recruitment scams on LinkedIn are a repeatable business model for a nation-state. The Binance hack is just the biggest invoice so far.

What Is a LinkedIn Recruiter Scam? How to Know if a Job Interview Is Fake

A LinkedIn recruiter scam is a fake recruiting process, usually started with a LinkedIn message, that uses the trust of a job search to get a candidate to install malware, hand over credentials, share personal data or send money. Most versions want something small from you. The Binance version wanted your laptop.

Here's how to know if a job interview is fake. Any one of these is worth a pause. Two or more, stop.

• The company is hard to verify outside the recruiter's own links, or its website and LinkedIn page are only a few months old.
• The recruiter's profile is new, thin on connections, or full of stock-looking photos.
• You're asked to download, install or run something: a code repo, an "assessment" app, a video plugin, a browser extension.
• The interview moves to WhatsApp, Telegram or another chat app for no clear reason.
• The pay is well above market for the role, or the process skips steps you'd expect.
• Someone works unusually hard to prove they're a real person.

That last one deserves a second look. In the Binance case, the fake HR rep volunteered personal photos and videos. Real recruiters don't need to prove they have a family.

Fake job interview text and email red flags

Not every scam starts on LinkedIn. A fake job interview text usually arrives from an unknown number, says you've been "selected" for a role you don't remember applying for, and pushes you to reply on a chat app. A fake job interview email often comes from a free email domain or a domain one letter off from the real company.

The fix is the same in both cases. Don't use the contact details in the message. Find the company yourself and confirm the recruiter exists.

Deepfake job interview warning signs

A deepfake job interview uses AI-generated or manipulated video. The FBI's own guidance on spotting fake candidates (in its North Korean IT worker alert) suggests asking the person on camera to wave a hand in front of their face, since that can make AI-generated video glitch. Mismatched lip sync, odd lighting around the hairline and a frozen background are other tells. That advice works in both directions.

Job Seekers: Here Is What You Should Know

You can't control how good the fakes get. You can control what you install and who you verify. Four rules.

• Go to the company's careers page yourself, not through a link they send, and verify the recruiter outside the conversation. Call the main number and ask for the recruiter by name.
• Your current employer's device is the prize, so never run a coding test or "assignment" on your work laptop. Ever.
• Photos, videos, a friendly HR rep and a polished LinkedIn profile can all be forged. Rapport is not proof.
• If someone pressures you to download something before the next round, stop and call your own security team first. Reporting it isn't disloyal. It might save your company.

How to verify a recruiter and avoid a LinkedIn recruiter scam

1. Search the company name plus "careers" in your browser and open the official careers site.
2. Confirm the job is posted there, with the same title and location the recruiter described.
3. Call or email the company using contact details from its official site, and ask whether the recruiter works there.
4. Only take an assessment through the company's own hiring platform or a browser-based test link, never a file you run locally.

It takes ten minutes. The Binance engineer didn't do it, and the bill was $6.3 billion.

TA and HR Leaders: How to Stop a LinkedIn Recruiter Scam Using Your Brand

Here's the uncomfortable part for our industry. The LinkedIn recruiter scam works because our hiring processes taught candidates to trust a multi-round interview, a friendly HR rep and a take-home test. Your employer brand is now an attack surface, and the attacker doesn't need your permission to use it.

• Publish one candidate safety page that tells candidates how your recruiters contact them, which email domain and phone number they use, and what you will never ask for (payment, software installs, personal banking details).
• It's time to stop sending downloadable take-home tests. Use browser-based, sandboxed assessments so no candidate ever runs your code on their own machine. If your process asks candidates to run code locally, a scammer can copy it word for word.
• Once a month, run a fake recruiter LinkedIn search on your own company name, and report every profile that isn't yours.
• Your engineers and finance staff get recruited too, so brief your own employees. Tell them how to report a suspicious recruiter, and make "no outside assignments on company devices" a written rule. (Binance told Fortune that employees in non-public-facing roles aren't allowed to keep LinkedIn profiles. Most companies can't go that far, but the logic is right.)
• Verify identity on both sides of every interview. Show candidates who you are, from a company email and a known number, and verify who they are before granting access to anything.

Candidate fraud runs the other direction

The same North Korean operators also pose as job seekers. The Justice Department announced charges in October 2026 in a remote IT worker scheme that used stolen or fabricated identities and U.S. "laptop farms" to get hired at more than 70 U.S. companies. The FBI's October 2026 public service announcement says no single indicator reliably catches these workers and recommends an "identity in depth" approach across the whole employment lifecycle.

So candidate fraud and recruiter fraud are two halves of the same playbook. If your team runs high-volume hiring, both belong on the same risk list, and identity checks should happen at more than one step, by a person who can say "this doesn't look right."

Recruit by text? Register the number and tell candidates

Frontline candidates mostly hear from employers by text. That makes the fake job interview text one of the easiest scams to run, because a candidate has no way to tell your recruiter's number from a scammer's.

Fix that on your side. Send recruiting texts from one registered business number, publish it on your careers site, and keep every conversation in one place so a manager can see what was sent. Our guide to TCPA and 10DLC compliance for text recruiting covers how number registration works, and text recruiting software is how most high-volume teams keep that number consistent across every recruiter.

The AI Governance and Compliance Lesson Inside the Binance Hack

One detail got less attention than the fake recruiter: the attackers used one of Binance's own internal AI tools to spread past one compromised laptop and into two more engineers' devices. Binance hasn't said exactly how the tool was abused. But the lesson for HR teams is plain enough.

Every AI tool your HR or TA team adds has access to something: candidate records, employee data, calendars, messaging. If an attacker gets one account, that tool's permissions become theirs. Treat AI access like you'd treat a new hire's access. Give it the least it needs, log what it does, and review it.

That's the same discipline we write about in recruiting AI implementation and change management and in our guide to AI in HR privacy and compliance. Security and compliance aren't separate projects. They're the same project.

A word on the compliance side. Automated employment decision tools are regulated. EEOC guidance on adverse impact applies to selection procedures, including software-assisted ones, and New York City's Local Law 144 requires bias audits for automated employment decision tools. At GoHire, software never makes a hiring decision. A person does, every time. You write the questions, you set the criteria, and your team decides who moves forward. That human review is also your best fraud check, because a person can notice when something about a candidate, or a recruiter, doesn't add up.

For the bigger picture on where AI fits in hiring, start with our recruiting AI guide and the more tactical AI recruiting guide for 2026. And if you're thinking about how fake content erodes candidate trust, Dane Frederick's GoHire Talks episode on building trust with real recruiting videos is worth your time.

LinkedIn Recruiter Scam FAQ