Binance breach criticized: DPRK fake-recruiter malware tactics were publicly documented for years

AccBalanced · x · 2026-11-04

Binance published initial findings on its October 29 security incident, calling it "highly sophisticated" and saying it blocked 57 suspected DPRK-linked attempts.

Security researcher Michal Koczwara pushes back: fake recruiters, fake interviews, and malicious coding tasks have been publicly documented for years (Unit 42's Contagious Interview, Securonix's DEV#POPPER, Datadog's Tenacious Pungsan), so "sophisticated" is a stretch. The real failure was that a developer ran a malicious interview assignment on a work laptop despite the threat being well known. He argues developer and security teams should be trained on DPRK tactics and build defenses around them.

Original post →

Binance breach criticized: DPRK fake-recruiter malware tactics were publicly documented for years

More from Safety