Unmasking North Korea’s Crypto Heist: The Binance Breach Exposed

North Korean cybercriminals have a track record of successfully stealing cryptocurrency, with estimates suggesting that 60% of total losses last year were attributed to groups linked to the DPRK. Their diverse attack strategies make detection particularly challenging.

In a striking incident last week, it reportedly took only 20 minutes for alleged North Korean hackers to raid $6.3 billion from Binance, setting a new record for crypto heists. The attackers infiltrated a Binance engineer’s computer through a phony job interview, leveraged an internal AI utility to seize control of additional engineers’ machines, and utilized stolen login details to commandeer an internal wallet signing mechanism, as confirmed by the exchange according to reports.

Historically, North Korean hackers have sought employment at cryptocurrency firms under false identities, attacked through third-party services, and tampered with widely used code libraries. Recently, the incorporation of AI has made their schemes even more believable.

Below are examples of common methods employed by North Korean hackers in cryptocurrency fraud.

Impersonating Employees

The chief security officer of Binance, Jimmy Su, stated in August 2025 that the exchange rejects suspected North Korean job applications daily, noting that nearly all major DPRK-associated hacks involved a fraudulent employee facilitating the invasion.

Su mentioned certain indicators in resumes that suggest the applicant is from North Korea, though specifics about these warning signs were not disclosed. Occasionally, malicious actors progress to interviews, where they utilize deepfake technology to alter their appearance and voice.

“The primary detection clue is that they typically exhibit a slow internet connection,” he explained to Decrypt. “The delay is often due to translation software and voice modulation being employed during the call.”

Those who are successful in securing employment tend to excel at their tasks. Su commented that North Korean employees often rank among the best within companies, potentially because multiple individuals share the responsibilities across various time zones.

The threat persists. In 2026, Binance reported that its security team identified and thwarted 57 potential cyber threat incidents connected to North Korea, employing methods ranging from fraudulent interviews to fake video conferencing applications.

Deceptive Job Interviews

In another tactic, attackers assume the role of recruiters targeting employees already working at reputable crypto firms. Often, the attacker will report technical issues during the interview and direct the victim to a link to update Zoom, which infects their device with malware.

“The DPRK group will also attempt to schedule calls with outward-facing employees,” Su noted to Decrypt. “They may present themselves as a DeFi project or investment firm. Alarmingly, they may offer salaries two to three times greater, all to entrap individuals in interviews.”

This methodology reportedly initiated the Binance breach. In September, a software engineer from Binance was approached on a reputable job board by someone masquerading as a project manager, who organized two interviews. During the initial meeting, a supposed HR representative built rapport through a live video call by showcasing a social media profile filled with personal content, representing a “more sophisticated and misleading approach than observed previously,” as described by Binance.

In the second interview, conducted via a messaging app, the engineer was instructed to download an “assignment” to his work computer. The code repository contained previously unidentified malware that executed during installation, substituting a legitimate developer tool with a harmful version and connecting to a server controlled by the attackers, thus evading Binance’s security measures.

One group associated with North Korea compromised at least 30,000 devices across over 100 countries from December 2025 to July 2026 using similar tactics. They depleted funds or credentials from more than 7,000 crypto wallets and transferred approximately $10.71 million to North Korea.

The group, known as WaterPlum or Contagious Interview, impersonated AI, cryptocurrency, or NFT organizations and assigned candidates technical interviews or coding tasks that necessitated downloading malware-laden files. Some employed AI face-swapping technology during interviews and later requested the candidates to do the same, attributing the disconnection to poor internet connection.

Code Library Corruption

According to Su, North Korean hackers frequently corrupt public code libraries, identifying it as the second most prevalent attack method, following the use of fake employees.

Node Package Manager (NPM) packages are sets of reusable, open-source code that developers commonly utilize. Attackers can replicate these packages and introduce a line of malicious code while maintaining the original functionality. As a result, victims can employ this contaminated code without realizing it, allowing the harmful code to embed deeper over time as new layers are built upon it.

In September 2025, the software security firm ReversingLabs discovered two NPM packages that utilized Ethereum smart contracts for downloading malware, an occurrence previously unseen. These packages were linked to a broader network of GitHub repositories, primarily promoted as crypto trading bots, which ReversingLabs assessed to have been manipulated artificially through inflated commits and stars.

These tactics are part of a “comprehensive campaign” by malicious entities targeting users through compromised public code libraries associated with blockchain technology, a method Binance has previously linked to North Korean hackers.

To address the threat, Su indicated that Binance requires employees to meticulously review NPM libraries.

Tampered developer tools were also implicated in the Binance hack. In June, a member of Binance’s wallet DevOps team inadvertently downloaded a compromised version of Homebrew, a widely-used software installer, while trying to access an AI coding tool he found via a search engine. Though Binance’s security team identified the issue, replaced the device, and reset his credentials, the incident exposed the engineer and his colleagues in the wallet infrastructure division to potential threats.

Attacks on Infrastructure

Prior to the Binance incident, the record for the largest crypto heist belonged to Bybit, which lost $1.4 billion in February 2025. Cybersecurity specialists disclosed that North Korean hackers executed the attack by embedding malicious code into the infrastructure of Safe—a crypto wallet provider utilized by the exchange.

The security teams relayed that harmful JavaScript code was directly inserted into Safe’s online systems; however, the method of infiltration was not clearly established.

Bybit confirmed to Decrypt that its infrastructure had not been violated, with the hack solely resulting from third-party exploitation.

The Binance breach specifically targeted the exchange’s systems. On October 29, the intruder leveraged stolen credentials to deploy a container for illicit access to an internal wallet signing service, facilitating transactions outside Binance’s standard withdrawal processes. On Ethereum, the signing service was exploited to leverage EIP-7702, a protocol that permits an account to delegate execution rights to a smart contract, granting the attacker partial control over a Binance hot wallet.

The on-chain permissions continued to function even after Binance halted withdrawals. Due to the multi-party computation employed in the hot wallet, there was no single private key that Binance could quickly use to nullify them, as reported by the exchange.

Scams Enhanced by AI

Every one of the aforementioned attack techniques can be amplified through the use of AI technologies.

Earlier this year, Google issued a warning about an AI-driven malware initiative targeting crypto enterprises linked to North Korea. Su from Binance echoed concerns, noting that AI tools have the potential to enhance the effectiveness of cyber attacks.

Worries regarding AI-powered breaches have surged in recent months, especially after Ethereum co-founder Vitalik Buterin stated in October that it’s “feasible” for AI to decrypt encryption in the next couple of years. This was highlighted during a significant advancement in AI-driven mathematical problem-solving, with OpenAI claiming to have resolved a 90-year-old mathematical conundrum in mere days. Experts are urging the sector to gear up for potential AI-propelled attacks against encryption.

Although there are no verified instances of North Korean hackers utilizing AI to compromise encryption at this time, the speed at which they have integrated AI into their operations may necessitate future preparedness in the industry.