A great job offer. A dangerous download. What the Binance hack can teach you.

What is new at Binance?

Binance’s preliminary report of 3 November says an employee received a malicious coding assignment through a fake recruitment process. This formed part of a multi-stage attack. Independent review is still to follow.

A convincing story is not proof

Social engineering means trying to gain your trust so that you take an action. You do not have to be a programmer to encounter it. A project, collaboration or job application can also prompt an everyday user to open a file.

Fictional example: Eva is looking for freelance work. A recruiter knows her experience, holds a friendly video interview and then sends a “small test”. Eva feels valued. But the conversation does not tell her who created the file or what it does on her computer.

Check 1: confirm the sender through another route

Find the company’s official website yourself. Use a contact listed there to ask whether the person and vacancy genuinely belong to the company. Do not rely only on the phone number or link supplied by the recruiter.

A logo, a long profile history or a familiar video platform is not proof of identity. A real company can also be impersonated. Verify the particular contact, not just whether the company name exists.

Check 2: treat a download as a separate decision

An introduction does not oblige you to install software, a browser extension or a script. If someone asks for extra software just to hold a conversation, stop and check why it is needed and where it officially comes from. Do not disable security because the other person asks.

Have unfamiliar code reviewed before a technical test. Do not casually run it on a work computer or the device you use to manage crypto. A familiar download platform does not make every file it hosts trustworthy.

Check 3: do not let pressure decide

In our fictional example, Eva is told: “Install this now or lose the opportunity.” She asks for time and independent confirmation. That does not automatically prove the offer is fake, but it prevents excitement from replacing her checks.

Already ran suspicious software? Disconnect that device from the internet and contact your IT team or a trusted security professional. Stop using the suspect device for sensitive accounts.

What do you gain from this?

You do not need to understand every attack technically. Learn to notice when a friendly conversation turns into a request for access to your device or information. That is your moment to pause.

Practise with this article’s three practical questions in the Mini App. The website’s free quizzes offer further learning at three levels. A good score is practice, not a safety guarantee.