Connect your Claude, Codex or OpenClaw for full transcripts on millions of podcasts. Two week free trial, cancel anytime.

Start free trial →
DH David Hoffman David Hoffman Co-founder of Bankless, a media company covering Ethereum and crypto markets, and general partner of Bankless Ventures, an early-stage crypto investment fund he...

“They set up a fake job interview with a Binance employee. … They gave this person a coding task for the job interview, but the said coding task that the person downloaded was actually malware, actually spyware. So that got onto that person's computer because that Binance employee's computer was inside the Binance network. That software was able to spread to other people's computers … one of the computers that the software got access to had the private keys.”

Bankless · Crypto & Web3 · November 2026

“They set up a fake job interview with a Binance employee. … They gave this person a coding task for the job interview, but the said coding task that the person downloaded was actually malware, actually spyware. So that got onto that person's computer because that Binance employee's computer was inside the Binance network. That software was able to spread to other people's computers … one of the computers that the software got access to had the private keys.” — David Hoffman, Bankless

Context

The hosts were reviewing how North Korean hackers pulled off the huge Binance theft. Hoffman walks through the attack chain, which started with a social-engineering trick rather than any cryptographic break.

Transcript

Bankless Around 27:38 into the episode
David Hoffman

Yeah. Yeah. I mean, the core difference between this and FTX was that FTX had just so much contagion. And that was downstream of the other contagion from Three Arrows Capital. So

Ryan Sean Adams

he was lying about it. He was like, he's also

David Hoffman

…Korea got access. So I think this is kind of the thing worth reading about so that we can kind of see what AI attacks of the future look like. Whether or not it was, I'm sure AI was getting involved somewhere, but it wasn't really like AI driven. They set up a fake job interview with a Binance employee. So somebody who works at Binance was given the opportunity to interview with another company. They gave this person a coding task for the job interview, but the said coding task that the person downloaded was actually malware, actually spyware. So that got onto that person's computer because that Binance employee's computer was inside the Binance network. That software was able to spread to other people's computers, which gave them permission to run malicious code and gave access to move crypto because one of those, one of the computers that the software got access to had the private keys. They abused an Ethereum feature called EIP 7702. This is something with the smart contract wallet that Binance Heist. But once they got access to that, they could make unapproved transactions approved and allowed them to…

Ryan Sean Adams

It played out over months too, right? So the first infiltration was detected in July. And then sort of they gradually kind of like ramped this out, social engineered this employee, but this employee was doing a job interview on a work laptop, downloading software on a work laptop, a fake company…

David Hoffman

difference, the comparison is that the people running Tornado Cash software are Ethereum node operators. You're just running all of Ethereum because all of the smart contracts live on Ethereum. With ThorChain, the ThorChain is run by node operators. So there's a direct one-to-one relationship with…

Ryan Sean Adams

If you have the ability to freeze or stop processing these transactions, then stop processing. Then

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.

More from Bankless