Compiled by: Baihua Blockchain

​​​​

North Korean hackers are notorious for efficiently stealing cryptocurrency; an estimate claims that last year, 60% of all cryptocurrency losses were attributed to hacker groups associated with North Korea. These hackers exploited various attack vectors, making it increasingly difficult to detect them during their operations.

Last week, suspected North Korean hackers stole $6.3 billion from Binance in just 20 minutes, marking the largest recorded cryptocurrency hacking incident. The trading platform stated that the attackers infiltrated the work computer of a Binance engineer through a fake job interview and used internal AI tools to gain control of other engineers' computers, subsequently hijacking the internal wallet signing service with stolen credentials.

In the past, it was known that North Korean hackers would use false identities to secure jobs at cryptocurrency companies, launch attacks via third-party infrastructure, and poison widely used open-source code repositories. Recently, they have begun to utilize AI to make all these methods more convincing.

Here are some examples of tactics commonly employed by North Korean hackers in cryptocurrency attacks.

Fake Employees (Undercover Job Applications)

Binance's Chief Security Officer Jimmy Su told Decrypt in August 2025 that the trading platform rejects resumes suspected to be from North Korea on a daily basis, and at the time, “almost all major hacking attacks involving North Korea” had cases of internal fake employees assisting in facilitating the attacks.

Su noted that resumes often contain certain obvious signs indicating that the applicants are from North Korea, but the trading platform refrains from disclosing the specific details of these warning signals. However, at times, malicious attackers successfully reach the interview stage, during which they use deepfakes to alter their appearance and voice.

“The only truly effective method of detection is they almost always experience network latency,” he told Decrypt. “This is because translation software and voice changers operate in real-time during calls… that’s why their responses always have delays.”

Individuals who are actually hired usually perform remarkably well, raising suspicion. Su stated that North Korean employees typically rank among the top performers in company evaluations, likely because multiple people share the same role across different time zones.

This threat has never ceased. Binance reported that its security team detection and stopped 57 suspected cyber threat incidents related to North Korea in 2026, with tactics ranging from fraudulent job interviews to fake video conferencing software.

Fake Job Interviews

Attackers also reverse-engineer the scam, disguising themselves as recruiters targeting current employees of well-known cryptocurrency companies. Attackers often claim that there are video or audio glitches during the interview, and then send victims a malicious link to update Zoom, resulting in malware infection on their devices.

“North Korean organizations also attempt to schedule calls with external-facing employees,” Su told Decrypt. “They either masquerade as DeFi project representatives or impersonate investment firms. Worse, they lure individuals with senior positions offering two to three times the normal salary, simply to get them to attend an interview.”

According to Binance, the attack they suffered began this way. In September this year, a Binance software engineer was contacted by someone claiming to be a project director on a legitimate recruiting platform and scheduled two interviews. In the initial interview, a supposed HR representative established trust through a video call, showcasing a social media account filled with personal photos and videos; Binance described this tactic as “more sophisticated and deceptive than anything seen before.”

In the follow-up interview conducted via chat software, the engineer was asked to download a ‘test assignment’ to their work computer. This code repository contained previously unknown malicious code, which ran quietly during the installation process, replacing legitimate development tools with malicious versions that then connected back to servers controlled by the attackers, successfully evading Binance's security defenses.

A hacker organization associated with North Korea used similar techniques to infect at least 30,000 devices across over 100 countries from December 2025 to July 2026. The organization stole funds or credentials from over 7,000 cryptocurrency wallets and transferred approximately $10.71 million back to North Korea.

This group, known as WaterPlum (or Contagious Interview), typically masquerades as AI, cryptocurrency, or NFT companies, assigning technical interview questions or programming tasks that require downloading files containing malware. Some hackers appear in interviews using AI face-swapping software, then use poor internet connection as an excuse to turn off the camera and ask the job seekers to do the same.

Code Repository Poisoning

Su also informed Decrypt that North Korean hackers frequently poison public code repositories and listed this as the second most common attack vector after fake employees.

Node Package Manager (NPM) packages are reusable open-source code collections frequently used by developers. Attackers can clone these legitimate packages and implant a small line of malicious code while maintaining their original functionality. This means that victims may completely fail to detect anomalies when using the contaminated code repository; as layers of development stack up, the latent malicious code can become increasingly entrenched.

In September 2025, software security firm ReversingLabs discovered two NPM packages that deployed malware via Ethereum smart contracts, which they indicated was a previously unseen tactic. These malicious packages were linked to a larger network of GitHub repositories, most of which masqueraded as cryptocurrency trading bots, with thousands of commit histories and stars; ReversingLabs believes the vast majority of these are fraudulently inflated.

This strategy is part of the “precision coordinated action” of malicious hackers, who aim to breach user systems by poisoning public code repositories related to blockchain; Binance has also attributed this attack vector to North Korean hackers.

Su stated that to guard against such threats, Binance requires employees to conduct thorough screening of NPM code repositories using extremely stringent standards.

Compromised development tools also played a role in the Binance hacking incident. The trading platform reported that in June this year, a member of the Binance wallet operations (DevOps) team inadvertently downloaded a compromised Homebrew installation program (a popular package management tool) while trying to install an AI programming tool found through a search engine. Although their security team identified the issue, replaced the device, and rotated their access credentials, the incident had already exposed the engineer and their wallet infrastructure team colleagues to the attackers’ view.

Infrastructure Attacks

Before Binance faced significant damage, the dubious record for the biggest theft in cryptocurrency history belonged to Bybit, which lost $1.4 billion in February 2025.

Cybersecurity companies revealed that North Korean hackers completed the attack by injecting malicious code into Safe's infrastructure—Safe is the cryptocurrency wallet service provider used by the trading platform. Security agencies noted that malicious JavaScript code was directly injected into Safe's online infrastructure. However, it is unclear how the attackers managed this.

Bybit told Decrypt that its own infrastructure “was not breached”, and that the hacking incident was entirely due to a third-party service provider experiencing a vulnerability.

In contrast, the attack targeting Binance directly aimed at the trading platform's core systems. On October 29, the attackers utilized stolen credentials to deploy a container and gained unauthorized access to the internal wallet signing service, enabling them to initiate transactions while bypassing Binance's normal withdrawal processes. On the Ethereum network, the attackers maliciously exploited the signing service through the EIP-7702 protocol (which allows accounts to delegate execution authority to smart contracts), thus granting partial control of Binance's hot wallet to the smart contracts controlled by the attackers.

Even after Binance suspended withdrawals, these on-chain authorizations remained effective. The trading platform stated that because its hot wallet uses multi-party computation (MPC) technology, Binance does not have a single private key to immediately revoke these authorizations.

AI-Powered Scam Tactics

Every attack vector mentioned above can be entirely enhanced and upgraded using AI tools.

Earlier this year, Google warned that hackers from North Korea were using AI-driven malware to launch attacks against cryptocurrency companies. Likewise, Binance's Su noted that AI tools are being used by hackers to significantly enhance the effectiveness of attacks.

In recent months, concerns about AI-enabled hacker attacks have grown significantly. Ethereum co-founder Vitalik Buterin stated in October that it is “entirely possible” that AI will break existing encryption in the next two years. This coincided with explosive breakthroughs in AI in the field of mathematical reasoning, as OpenAI claimed to have solved a 90-year-old mathematical problem in just a few days. Industry experts are calling for the sector to be vigilant against AI-driven attacks targeting underlying encryption algorithms.

Currently, there is no concrete evidence that North Korean hackers have used AI to break encryption algorithms. However, given their rapid adoption and integration of AI in other areas, the cryptocurrency industry may need to prepare defenses for the next potential wave of impact.

Article link: https://www.hellobtc.com/kp/du/11/6491.html

Source: https://decrypt.co/382420/five-ways-north-korea-breaks-into-crypto-firms-and-how-binance-was-hacked