Binance's Own CSO Described the $6.3B Hack Tactic Months Before It Happened
Months before the $6.3 billion Bybit hack rewrote the record books, Binance's chief security officer Jimmy Su sat down for an interview and walked through the exact playbook attackers would later use, almost step by step.
In a July interview, Su explained how bad actors were embedding malware inside fake coding assessments sent to exchange employees. The target accepts what looks like a routine technical test. The file runs. The device is compromised. The attacker is inside.
That is not a hypothetical. That is the Bybit hack.
The Warning That Was Already on Camera
Su's interview was not buried in an internal memo or a classified security briefing. It was public. He described the social engineering vector clearly, flagging fake job-related documents and coding challenges as a growing attack surface targeting crypto firms specifically.
The Lazarus Group, the North Korea-linked operation widely attributed to the Bybit attack, has refined this exact method over years of targeting developers and finance employees across the industry. They do not crack wallets. They crack people.
Bybit CEO Ben Zhou later confirmed the breach originated from a compromised device belonging to a Safe\.global developer. A manipulated transaction interface masked the true destination of funds. By the time anyone noticed, $6.3 billion had moved.
Why This Pattern Keeps Working
The uncomfortable truth is that the technical defenses inside most crypto firms are strong. Multisig, cold storage, hardware security modules: the infrastructure looks solid on paper. But the human layer is still the most reliable entry point for a sophisticated state-sponsored attacker.
Fake interviews. Trojanized PDFs. Poisoned GitHub repos. These are low-cost, high-yield weapons when the target is a developer with privileged access to signing infrastructure. And in an industry that moves fast and hires aggressively, the vetting process for third-party tools and test files is rarely airtight.
Su's warning was accurate. The industry just did not treat it like a countdown.
What Crypto Holders and Teams Should Watch Now
If you are holding assets on any centralized exchange, the Bybit incident is a stress test worth reviewing. The exchange covered losses and remained solvent, but that outcome was not guaranteed and cannot be assumed next time.
For teams building in crypto, the immediate priority is auditing who has signing authority, what devices they use, and what files those devices have executed in the last six months. The attack vector Su described is not exotic. It is repeatable.
The next $6.3 billion warning is probably already on camera somewhere. The question is whether anyone is treating it like one.