recruitment

According to Web3 developer brucexu.eth, he encountered a phishing scam involving fake recruitment in January this year. After using Cursor to open the project directory provided by the other party, his device was infected with a Trojan, but ultimately there was no asset loss.He stated that the attacker provided a code repository through the recruitment process; he initially thought it was safe to just view the code without running it, but after analyzing the sample, Yu Xian, the founder of Slow Mist, warned that opening the project directory could also trigger malicious code. After confirming the infection, he transferred assets, rotated credentials, and reinstalled the system.

The preliminary investigation report on the security incident released by Binance on October 29 shows that the attack began with a fake recruitment. According to the report, in September, a Binance software engineer was contacted by someone impersonating a project director through a legitimate job platform. After undergoing a fake HR video interview and a fake CEO second interview, the engineer was asked to download a homework code repository on their work computer, which contained a zero-day Trojan that bypassed endpoint protection. The attackers then used the compromised device and an internal AI tool to control the computers of two other wallet engineers, stealing deployment credentials, and ultimately executed a malicious script on October 29 to transfer approximately $6.3 billion. Binance stated that it has frozen or intercepted about $2.85 billion and has compensated 98% of the affected assets.This method is almost identical to the March 2022 theft of the Axie Infinity sidechain Ronin cross-chain bridge. At that time, the North Korean hacker group Lazarus contacted a senior engineer at developer Sky Mavis through LinkedIn for a high-paying position. After several rounds of interviews, they sent an offer file containing a Trojan, which allowed them to control the private keys of the validation nodes, stealing approximately $625 million. The Binance report also noted that this year, 57 suspected cyberattacks related to North Korea have been detected and intercepted, with methods including fake interviews, malware disguised as popular development tools, tampered software packages, and browser plugins, among others.

According to Caixin, the storage chip manufacturer Changxin Technology issued a reminder on the 29th, stating that the company has recently discovered that illegal individuals and unauthorized intermediary organizations are falsely using the names "Changxin Technology," "Changxin Group," and "Changxin Storage" to spread false recruitment information on online platforms.Changxin Technology reminds everyone not to download unknown software, not to click on unfamiliar links, and not to provide personal sensitive information to unofficial personnel; do not participate in activities that require payment or tasks to obtain job opportunities; do not trust false promises spread by unofficial social media accounts, as well as fabricated job locations and salaries.

On October 25, 2026, Bilibili UP Master "Brother Feng on the Run" released a video titled "A Day of Daily Settlement Experience at Majia Bridge." In the footage, street stalls display the words "Binance New User Promotion," with the relevant segment appearing around 04:08 in the video.Majia Bridge is located outside the sixth ring road in the southeast of Beijing, adjacent to the Yizhuang Economic and Technological Development Zone, where a large daily settlement labor market has spontaneously formed. The video and related description state that APP user acquisition refers to intermediaries finding passersby to download and register the application, and sometimes they also need to complete their first use, after which cash rewards are paid to them.

According to Digital Asset, the security platform OpenSourceMalware revealed in a program on October 21 that a North Korea-linked hacking group is using a technique called Contagious Interview, luring job seekers in the cryptocurrency industry through LinkedIn to invite them to visit private code repositories and install software packages required for development tasks.The attackers set up a .npmrc configuration file in the repository, causing npm to download dependencies from a specified external package repository instead of the public registry, which could potentially execute malicious code during the installation process and reduce the likelihood of being detected by public security scans. Paul McCarty, co-founder of OpenSourceMalware, stated that this type of technique has been observed recently among attackers. The specific number of victims, affected companies, or the amount of digital asset losses has not yet been disclosed.

Ethereum Institutional official X platform has released a recruitment notice, currently hiring a head for the Asia-Pacific region in Tokyo. This role involves establishing partnerships with Japanese banks, financial market infrastructure institutions, asset management companies, and enterprises, as well as planning and organizing communication meetings and presentations aimed at financial institutions and institutional investors, promoting Ethereum as the infrastructure for next-generation financial services.Job requirements include 5 to 7 years of practical experience in banking, asset management, capital markets, payments, or financial infrastructure, proficiency in both Japanese and English at a business level, experience in the digital asset field, particularly in products or collaborative business with financial institutions and institutional investors, and a broad network with Japanese financial institutions and institutional investors.

Franklin Templeton's digital asset account FTDA posted job openings on X, publicly announcing multiple positions related to digital assets and cryptocurrency business, and stated that private messaging communication is now open.Specific positions include Head of Digital Asset Product Strategy, Head of Capital Formation for Franklin Crypto, Head of Private Credit for Franklin Crypto, Digital Audience Engagement Project Manager, and Vice President of Business Development for the Cryptocurrency Market.

DeepSeek has integrated the Harness team along with the Web, App, and Platform teams into the Product Department, responsible for all product, design, and development work of the company, led by Cui Tianyi as the head of the Product Department.DeepSeek is currently hiring product managers, product designers, and project managers, with product managers divided into two directions: AI products and Agent Harness, covering web, App, open platform, and Harness product lines. Job requirements include experience in complete delivery, experience with Agent-type products, as well as skills in prototyping, data analysis, and communication within open source communities. The work locations are Beijing and Hangzhou, with both full-time and internship positions available.

According to Axios, the venture capital firm Andreessen Horowitz (a16z) has laid off most members of a 34-person team responsible for helping portfolio companies recruit talent. Axios reports that the information comes from multiple sources, and the company spokesperson declined to comment.The report states that this service is one of the main supporting services a16z promotes to tech founders. Remaining members of the company's full stack talent team will be reassigned to specialized investment groups, such as growth investment or crypto investment, with plans for each group to build teams to meet their needs, no longer relying on a centralized team. Currently, all team members are still listed on the company website.

According to CoinDesk, data from the cryptocurrency recruitment platform CryptoJobsList shows that the number of job postings by cryptocurrency companies in September increased from 382 in July to 1,241, continuing to rise from 886 in August, and surpassing the most active month earlier this year, January, which had 573 postings. The number of companies posting jobs in September rose to 125, up from 107 in July, and briefly dropped to 77 in August.The platform believes that the recovery in hiring in September aligns with the seasonal pattern of business returning to normal after the summer off-season in the Northern Hemisphere, but the data indicates that seasonality is not the only reason: the number of job postings in August had already doubled compared to July, and there was no similar surge from August to September in 2025; the most active month that year, October, had only 373 postings, with data from July to September remaining basically flat.In contrast to the increase in job postings, the number of applications fell from 25,700 in July to 24,631 in August, and further declined to less than 20,000 in September. CryptoJobsList interprets this divergence as a tightening competition for professional talent. Over the past three months, finance has been the largest recruitment category, followed by engineering and trading, with stablecoins, AI, security, and compliance also making the top ten; the most requested blockchain skills are Bitcoin, Ethereum, and Solana.

Co-founder and Chief Operating Officer Alon of Pump.fun stated that the company is hiring a support lead for the Trading Terminal and is recruiting more support positions for the Pump.fun app and launchpad.Alon mentioned that candidates need to be proactive, understand how to provide professional support to users, and be responsive, personally involved, and responsible for end-to-end support work. This position will manage the support team, liaise with VIP partners, and communicate user feedback to engineers. Alon also stated that Pump.fun is simultaneously hiring for junior support positions.

Stablecoin issuer Circle is hiring a "Senior Director, Ecosystem Growth, South Korea" in South Korea, responsible for developing market entry strategies, tracking regulatory dynamics, and establishing partnerships within the domestic financial and digital asset industry.The position requires candidates to have over 13 years of business development experience, familiarity with stablecoins, DeFi, and institutional financial liquidity, and fluency in both Korean and English. Circle previously stated that its strategy in South Korea is not to directly issue a Korean won stablecoin, but to collaborate with local Korean won stablecoin issuers to provide infrastructure connecting to the US dollar stablecoin.

The multi-chain Meme trading terminal GMGN released a recruitment notice on September 23, seeking talent globally, with 8 key positions available.This recruitment focuses on two main areas: product management and research and development. In the product management area, there are three positions: social community, user conversion, and on-chain trading, all based in Hong Kong and requiring full-time commitment. In the research and development area, there are five positions: EVM trading routing engineer, on-chain data development engineer, senior backend development engineer, senior blockchain development engineer (cross-chain direction), and smart contract engineer (Launchpad direction). Resumes should be sent to hr@gmgn.ai.GMGN stated that the team is dedicated to building the fastest multi-chain Meme trading terminal in the world, with members being deep on-chain users themselves. Recently, GMGN's perpetual contract trading feature was opened for public testing on September 21 and has supported 7 launch platforms including Pons on the Robinhood Chain.

According to Forbes, a warning jointly issued by multiple agencies including the Federal Bureau of Investigation (FBI) and the National Police Agency (NPA) of Japan indicates that the North Korea-linked hacker group WaterPlum (also known as Contagious Interview) will launch attacks on global IT developers from December 2025 to July 2026 by disguising itself as companies in the AI, cryptocurrency, or NFT sectors and offering fake job positions.Attackers contact job seekers on social media and recruitment platforms, luring them into downloading malicious files under the pretext of technical interviews or programming tests. They successfully infected over 30,000 devices, covering more than 100 countries and regions, and stole data from over 7,000 cryptocurrency wallets. Related funds of at least $10.71 million have flowed into wallets controlled by the attackers.

a16z Charts compiled recent data indicating that since January 2025, tech recruitment has shown a clear preference for years of experience, while the requirements for the number of skills have decreased, with a change of about 5% to 10%.The charts show that companies are lowering the weight of skill lists when screening positions, and are instead placing more emphasis on candidates' accumulated experience. This change is related to the skill gaps brought about by AI, which is rewriting the safety and employment landscape.

The venture capital firm a16z's crypto division, a16z crypto, is hiring a Head of Social Media, with a salary range of $199,000 to $232,000.This position is aimed at candidates who are extremely active online, understand crypto and internet culture, can create and deliver content, and can showcase intelligence in a non-corporate or non-awkward manner. Responsibilities cover podcasts, investments, events, editing, memes, short video editing, and social media strategy. This is a remote position, requiring some travel or attendance at offline events.

According to CNA, the Singapore Police Force (SPF) and the Cyber Security Agency of Singapore (CSA) reported that a cryptocurrency scam involving fake job postings and compromised software systems resulted in losses of $11.8 million.The scam group impersonated cryptocurrency company recruiters on LinkedIn, used forged domain names to send emails, conducted video interviews, and induced victims to download malware on company devices to complete "technical tests," thereby stealing session tokens, bypassing multi-factor authentication, and ultimately transferring cryptocurrency.

According to official news, Bitget C2C has officially launched the merchant ecosystem recruitment. This recruitment adopts a selective and invitation-based model, with dedicated business managers providing one-on-one access. The platform requires that applying merchants must be certified merchants from other platforms and have more than 180 days of industry experience; for senior high-level merchants, a "certificate direct upgrade channel" is open, allowing for direct upgrades to bulk merchants based on relevant certifications and transaction records, enjoying expedited review, 1V1 exclusive connection, and platform traffic exposure support.To accelerate ecosystem construction, Bitget has launched a dual incentive program. New merchants can receive a 100 USDT onboarding reward after completing specified tasks; existing merchants can receive up to 200 USDT referral rewards for each new merchant they successfully refer, with no limit on the number of referrals. The event will last until September 30 at 23:59 (UTC+8). For more details, please refer to the Bitget official platform.