North Korean hackers used a fake job interview to breach Binance and drain billions, and the same technique targets individual crypto holders every day. Your device, your wallet, and one suspicious coding test could be all it takes.

This post may contain links from our sponsors and affiliates, and Flywheel Publishing may receive compensation for actions taken through them.

Binance’s security breach highlights a concerning trend in the crypto space – hackers are using fake job interviews as bait. The exchange reported that in September 2026, cybercriminals compromised an engineer’s device through a fake job interview. They introduced malware into the engineer’s system, exploited an internal AI tool, and used stolen login credentials to access a wallet-signing service.

These hackers also manipulated the EIP-7702 authorization on Ethereum (CRYPTO:ETH). According to Binance, $2.85 billion has been frozen or halted, and 98% of the affected assets have been successfully restored. While the FBI has pointed to North Korean hackers as the culprits, North Korea has denied involvement. Binance customers are fortunate to have a company that can cover their losses, but individuals who fall victim to similar tactics might not be so lucky.

North Korean Hackers Use Fake Job Offers to Target Crypto Holders

North Korea flag isolated on white background with clipping path. flag symbols of North Korea. flag frame with empty space for your text.

The same trick that affected Binance can hit individuals too. A September 2024 alert from the FBI revealed that North Korean hacking groups were scouting potential victims on professional networking sites. They would then reach out with tailored job offers. Watch for warning signs like requests to complete a “pre-employment test” using unknown code, scripts, or GitHub repositories.

Anyone using a self-custody wallet on a device they also use for job searching or freelance work is vulnerable. Typically, the bait will include recruiter messages, technical tests, or downloadable files. In 2025, Chainalysis reported 158,000 personal wallet compromises affecting roughly 80,000 victims, with an average loss of around $9,000 per victim. One discussion thread on r/ethereum highlighted the dangers of EIP-7702 delegations to drainer contracts, where users explained how to remove the delegation.

Crypto Transfers Can’t Be Reversed, and EIP-7702 Raises the Stakes

A close-up, top-down shot of numerous gold-colored cryptocurrency coins arranged on a reflective black surface. A prominent stack of Solana coins sits in the center, bearing inscriptions like 'SOLANA', 'Proof-of-History', 'Scalability', and 'Decentralized Dapp'. Other identifiable coins include Litecoin with its 'L' logo and 'VECHAIN' inscription, and Ripple with a world map and '&ripple' text. Several other coins with distinct patterns, including one with a 'STEEM' logo and another with a geometric design, are scattered around, creating a sense of depth.

When comparing traditional banking to crypto, a crucial difference emerges: fraud involving stolen debit cards can lead to investigations and potential recovery. However, in the crypto world, a signed transfer is permanent once it goes through. The blockchain treats a valid signature as approval. According to the latest CFPB report, companies often deny responsibility for scam losses, blaming user negligence or claiming they cannot reverse transactions.

Thus, a holder’s maximum loss can be tied to what their job-searching device can authorize. For example, someone keeping $20,000 in a browser wallet on that device risks losing the entire amount with a single harmful coding test. In contrast, someone who keeps only a small amount for spending while securing the rest in a hardware wallet will lose only what’s accessible on the risky device.

EIP-7702, introduced in a May 2025 Ethereum upgrade, raises concerns because it allows a signature to grant a piece of code control of an account. Revoke.cash alerts users that batch transactions can help phishing sites siphon several assets at once. Users can monitor delegations on their Ethereum addresses in Revoke.cash’s delegations tab and revoke suspicious ones by signing a new authorization directing them to the zero address.

A Split Wallet Setup Protects Crypto Better Than One Hot Wallet

Hands holding a wallet with a small amount of US dollars, close up

Relying on a single hot wallet on a personal computer poses significant risks. While convenient, it can lead to a complete loss of funds from a single bad download or unauthorized delegation, with no possibility of recovery from banks or service providers.

A better strategy is to adopt a split setup for managing crypto assets. Maintain a small hot wallet for daily transactions while storing larger savings in a hardware wallet that remains free from any delegations – a method highly recommended by Revoke.cash for long-term asset storage. Buy the hardware wallet directly from the manufacturer to improve security.

Using a regulated exchange can shift some risks onto the platform, as evidenced by Binance’s reimbursement practices. However, users should note the CFPB complaints about frozen accounts and delayed withdrawals, and even a phishing incident can leave an exchange account exposed.

Seven Habits That Stop the Fake Job Interview Trick

Doubtful recruiting managers look at African American applicant, unsure about candidature for open position, concerned dissatisfied employers consider black candidate at hiring. Discrimination concept

  1. Run code, tests, or installers from recruiters only on a separate computer that does not contain any wallets, and walk away from any interviews that require otherwise.
  2. Independently verify the recruiter by checking the company’s careers page, as the FBI warns that scam recruiters often impersonate legitimate firms.
  3. Keep your savings in a hardware wallet and reserve only your spending money in a browser or mobile wallet.
  4. Regularly check your Ethereum address for delegations and revoke any that seem unfamiliar by signing an authorization to the zero address.
  5. Carefully read every signature prompt and reject any delegation requests from links shared by unknown sources.
  6. If you execute a suspect file, treat your seed phrase as compromised and move your funds to a new wallet on a clean device; a stolen seed phrase can let attackers set up bots that siphon future transfers.
  7. Report any theft incidents to the FBI’s IC3, as relying solely on a platform to recover lost funds can be futile.

Could a Fake Job Interview Empty Your Crypto Wallet?

Yes, a fake job interview can indeed empty your crypto wallet if you’re not careful about where you hold your assets or how you interact with potential job offers.

Contact [email protected] for any questions or corrections.

Sam Daodu is a crypto analyst and the editor of 24/7 Wall St.'s Crypto Desk, where he covers Bitcoin, XRP, Ethereum, Solana and the altcoins investors search for most. His work focuses on price levels, spot ETF flows, on-chain data and the regulatory decisions that move crypto markets, written so a first-time buyer and a seasoned trader can both use it.
Sam has written about crypto professionally since 2019 and has published more than 2,000 articles. Before joining 24/7 Wall St., he wrote for crypto media outlets and Web3 companies and ghostwrote for crypto founders and token launches. His analysis is syndicated on Yahoo Finance, MSN and AOL and has been cited by other crypto news sites. He also founded MacLabs Marketing, a content and personal branding agency for crypto founders and executives.
When he isn't reading charts, Sam is usually at the gym or watching One Piece, a series he maintains has better tokenomics than most altcoins.