It started with a job interview
The biggest crypto theft in history did not begin with a genius breaking through a firewall. It began with an engineer looking for a new job.
Binance, the world's largest cryptocurrency exchange, recently lost a record $6.3 billion to hackers. The company has now explained how it happened, and the method should worry every IT company, not just crypto firms. The attackers did not need to break the technology first. They only needed to fool one person.
That is the real lesson for Nepal's growing IT sector. Our companies build software for banks, government offices, telecoms and clients overseas. If a company with Binance's money and security team can be tricked this way, so can a 30-person software house in Kathmandu.
What happened at Binance
According to Binance's own initial findings, reported by BBC News, the attack ran in several stages:
- A Binance engineer was approached on a real job-hunting platform and invited to interviews with a company that did not exist.
- The fake recruiters built trust slowly, even sharing social media profiles with personal photos to look genuine.
- In the second interview, the engineer was given a "test assignment" to download. It was malware, hidden well enough to avoid detection.
- Using his infected computer and a compromised internal AI tool, the attackers took over the laptops of two more engineers.
- From there, they gained control of the tools that move money and drained Binance's wallets.
Binance had to freeze withdrawals for customers worldwide. When it reopened, users pulled out billions of dollars. The company has apologised and says it has covered the losses, but the damage to trust is already done.
US agencies, including the FBI, have linked the attack to North Korea, which denies it. The same group was blamed for a $1.5 billion theft from the exchange Bybit in 2025. Fake job offers are one of its favourite tricks.
Why cybersecurity matters, especially in Nepal
Cybersecurity is not just about firewalls and antivirus. It is about protecting money, data and trust. Binance lost all three in one attack, and it started with a single download.
Nepal is not too small to be a target. We have already seen it happen at home:
- In January 2023, a DDoS attack on the Government Integrated Data Centre took around 1,500 government websites offline, and services at Tribhuvan International Airport were disrupted.
- Nepali banks have faced ATM hacks and a major attempt on a bank's SWIFT system.
- More recently, a ransomware attack on Data Hub, a data centre hosting systems for over 1,000 companies, disrupted NEPSE trading. Trading only resumed because backups at a recovery site in Butwal worked.
Nepal's IT industry is also growing fast through outsourcing. Foreign clients trust Nepali companies with their code and customer data. One breach can end that trust, and the contract with it.
The Binance case also shows a harder truth: the weakest point is often a person, not a server. Strong technology means little if one employee can be tricked into opening the door.
7 lessons for Nepal's IT companies
1. Train your people, not just your systems. Run short, regular sessions on phishing and social engineering. Use real examples like the Binance fake interview. Staff who know the trick are much harder to fool.
2. Treat job offers and "test tasks" as a risk. Many Nepali developers take freelance work and interviews with foreign companies. Tell your team: never run an unknown file or project from a recruiter on a work laptop. Use a separate device or a sandbox.
3. Keep work and personal devices apart. One infected personal download should not reach company code, servers or client data.
4. Give people only the access they need. At Binance, three engineers' laptops were enough to reach the money. Limit who can touch production systems, and require a second approval for sensitive actions.
5. Secure your AI tools too. The attackers used an internal AI tool to spread. If your team uses AI assistants or automation with access to code, servers or credentials, review what they can do and who controls them.
6. Have backups and a recovery plan, and test them. The Data Hub attack showed that a working backup site is what gets you back online. Know who to call, what to shut down and how to restore before an attack happens.
7. Turn on the basics. Multi-factor authentication, regular updates and strong passwords stop a large share of attacks. Nepal's National Cyber Security Centre has already advised government bodies to use practices like these. Private companies should not wait to be told.
The bottom line
Binance had billions of dollars and a large security team, and it still lost $6.3 billion because one engineer trusted the wrong job offer. Nepali IT companies have far smaller budgets, which makes the cheap fixes even more important: trained staff, limited access, tested backups and basic security habits.
Cybersecurity is not a cost. It is what keeps your clients, your data and your reputation safe.
Has your company or team ever faced a phishing attempt or a suspicious "job offer"? Share your experience in the comments.
Sources
- BBC News, "Binance says fake job interviews used as part of $6.3bn crypto hack" (Liv McMahon)
- Onlinekhabar: ransomware attack on Data Hub and NEPSE
- Kathmandu Post: Singha Durbar server attacks, 2023
- Republica: How safe is Nepal from cyber attacks?
- Ratopati: Nepal's digital insecurity
- B360 Nepal: Nepal's government cyber crisis
.png)