The method used to compromise Binance is identical to that of the 2022 Axie breach, both originating from fake recruitment.

Binance’s preliminary investigation into the October 29 security incident, released on November 4, shows that the attack began with a fake recruitment scheme.

According to the report, in September, a Binance software engineer was contacted through a legitimate job platform by someone impersonating a "Project Director." After going through a fake HR video interview and a second interview with a fake "CEO," the engineer was instructed to download an "assignment" code repository onto their work computer, which contained a zero-day Trojan that bypassed endpoint protection. The attackers then leveraged the compromised device and an internal AI tool to take control of the computers belonging to two other wallet engineers, stole deployment credentials, and ultimately executed a malicious script on October 29 to drain approximately $6.3 billion. Binance stated that it has frozen or intercepted around $2.85 billion and covered 98% of the affected assets.

This tactic is nearly identical to the March 2022 theft from the Axie Infinity sidechain Ronin cross-chain bridge. During that incident, the North Korean hacking group Lazarus reached out to a senior developer at Sky Mavis on LinkedIn posing as a recruiter with a lucrative job offer. Following multiple rounds of "interviews," the group sent a malware-laced offer file, compromised the private keys of validator nodes, and stole approximately $625 million.

The Binance report also states that 57 cyberattacks suspected to be linked to North Korea have been detected and blocked thus far this year, employing tactics such as fake interviews, malware disguised as popular development tools, tampered software packages, and browser extensions.