Author: Chainalysis

Translated by: ShenChao TechFlow

ShenChao Introduction: As the most devastating security incident in the history of cryptocurrency development, the Binance $6.4 billion theft case was not caused by a single smart contract vulnerability or a zero-day exploit in a high-risk system; rather, it was the culmination of years of meticulous planning by a North Korean state-sponsored hacker organization on "social engineering infiltration." From early phishing links cast on workplace social platforms to tailored "high salary bait and interviews" aimed at core protocol developers, North Korean hackers have weaponized what seems to be a compliant talent recruitment process into a Trojan horse that directly injected into the intranet.

In the Binance case, the attackers gained the trust of victims through impersonating legitimate headhunters, conducting multiple rounds of simulated technical screenings, and establishing an initial foothold on victims' terminals using malicious coding test questions. They subsequently leveraged local active credentials and internal collaboration tools to make fatal lateral movements towards core business clusters. This systematic breach marked the failure of traditional static network perimeter defenses, and cryptocurrency firms along with security teams must prioritize endpoint behavior auditing, continuous red team simulations, and real-time on-chain fund movement monitoring at the highest levels.

Executive Summary

Binance discloses that North Korea's fake job scam was behind its $6 billion theft: The attackers exploited fictitious job opportunities and a series of fake interviews to target Binance employees, turning an otherwise ordinary recruitment process into a breakthrough for the largest theft in cryptocurrency history.

Smaller attacks have helped North Korean hackers continuously refine their attack scripts: Over the past 18 months, Chainalysis has confirmed that losses exceeding $14.3 million are attributable to similar North Korean-linked fake interview scams. Analysis shows that such early infiltrations allow North Korean attackers to repeatedly hone their techniques on smaller targets before using them on higher-value targets.

This attack is just the tip of the iceberg of North Korea's vast illegal job ecosystem: Fake interview scripts are just one aspect of North Korea's high-profit cybercrime ecosystem, which also includes identity fraud involving IT outsourcing job scams and on-chain money laundering networks. Chainalysis continues to track the evolution of such tactics and the underlying crypto infrastructure.

North Korean hackers stealing as much as $6.4 billion from Binance began with the classic tactic they have long mastered: job fraud.

Chainalysis investigators have been closely monitoring this strategy for years. This tactical method is diverse: in the Binance case, North Korean hackers induced victim employees to apply for fictitious positions, subsequently implanting malware into their computers. However, in other cases, attackers often directly impersonate the job seekers themselves, either using false identities to receive salaries that enrich the state regime or taking the opportunity to infiltrate corporate internal systems, or even both.

Every security incident leaves traces on the blockchain. In the past 18 months, Chainalysis has confirmed that over $14.3 million in losses originated from similar North Korean-related fake interview and malware scams. These attacks target a broad range of victims, from individual cryptocurrency holders, independent private wallets, to institutional organizations, crypto protocols, and DAOs. Binance is merely the latest victim in this series of targeted attacks.

“We have identified dozens of cases of wallet theft triggered by fake job interviews on an individual level,” pointed out Chainalysis senior intelligence analyst Tom McLouth. Although the losses in early incidents ranged from tens of thousands to millions of dollars, the deeper significance lies in the practical experience these exercises accumulated for attackers.

McLouth further explained that in successive infiltrations, the North Korean hacker organization "is continuously refining and evolving its attack methodologies," sharpening tactical pathways and gradually building up the practical capabilities needed to hunt higher-value targets, "which is precisely why the largest heist in history eventually took shape.”

From this industry background, the theft incident encountered by Binance is by no means an isolated occurrence, but rather the culmination of months and even years of meticulous planning and real-world practice by the attackers.

How Fake Interviews Opened Binance's Doors

On Tuesday, Binance released preliminary investigation results regarding the multi-phase attack by North Korean hackers on its exchange.

The attack began in September when a Binance engineer received a job interview invitation. Binance disclosed how the attackers spent weeks building trust with the employee: they first approached the employee on a legitimate recruitment platform with fictitious job opportunities.

After two rounds of interviews organized by a fictional company, the Binance employee was asked to download a programming test assignment containing malicious code, thereby giving the attackers their initial foothold. After that, the hackers deployed malware, using the victim's access to internal AI tools to further penetrate deep into Binance’s core intranet system.

While the scale of this system breach is unprecedented, the breakthrough method employed by the hackers is not novel. As Chainalysis's global services senior director Alec Zebrick pointed out in an interview research report: North Korean malware conducts a carpet search for cryptocurrency mnemonic phrases and leftover data from password managers within infected systems.

The credentials collected by the attackers during the initial action can rapidly transform into keys to unlock a multitude of associated accounts, with a reach far exceeding the single infected device initially compromised. In the Binance attack, it was this same underlying script, using fake job interviews to obtain an initial foothold that ultimately allowed the hackers to penetrate directly into the core business structure of the exchange.

How North Korean Malware Lurks and Implant in Target Systems

The Binance theft case is merely one reflection of North Korea's highly profitable illegal job ecosystem.

North Korean hackers extensively employ various social engineering tactics, which not only include other styles of fake recruitment scams but also encompass identity fraud involving IT workers infiltrating legitimate companies from multiple perspectives.

Chainalysis has been continuously tracking the evolution of North Korean hackers and the deployment of such technology through other emerging methods. One new threat that is beginning to emerge is the attackers using blockchain space to conceal malware command instructions, a tactic we refer to as "Blockchain Dead Drops" (BDD).

Our specialized research report indicates that in the past year, the number of cyberattacks that leverage blockchain for covert communication has surged by five times, significantly driven by state-sponsored hacker organizations, possibly catalyzed and supported by open-source weight AI large models.

Analysis shows that North Korean hacker organizations have been employing the technology collectively termed "Etherhiding" since early 2025, aiming to establish a perpetual link between infected victim computers and malware command and control (C2) infrastructure in their fake interview attacks.

The hackers choose on-chain transactions because public chain ledgers possess immutability and resistance to censorship characteristics, making blockchain a more resilient refuge for deploying C2 relay networks compared to traditional centralized servers, which can be easily shut down by law enforcement.

The Chainalysis on-chain analysis team revealed a high-redundancy technology employed by North Korean hackers: by distributing C2 communication links across two different public chains, TRON and Aptos, they increase redundancy (Redundancy) to guide infected endpoints to eventually redirect to a third chain, BSC.

The attackers write specific pointers on TRON and Aptos, both targeting a specific transaction on BSC. Once the victim machine queries the TRON node encounters an issue, it automatically and seamlessly switches to Aptos as a backup redundancy channel. Whichever path is taken, the infected endpoint can ultimately accurately locate the target address on BSC storing the malicious payload.

Recently, North Korean hackers have also evolved a new covert tactic known as "Null Receiver." The hackers directly encode command data originally intended for C2 communication into a meticulously constructed on-chain burn address.

This address has no real entity controlling it, nor is it used to store any cryptocurrency assets. However, when malware-infected endpoints capture the address string, they can directly reverse decode it into execution instructions, thus quietly completing command relaying and control.

Figure: North Korean hackers utilize TRON and BSC burn addresses to store encoded instructions and encrypted payloads in the on-chain C2 communication architecture

Unveiling North Korea's Profitable Illegal Job Ecosystem

On the other side of North Korea's job fraud arsenal is its extensively laid out large-scale IT labor projects. In such scams, North Korean technicians disguise themselves as legitimate job seekers, applying for and infiltrating major enterprises worldwide.

They do this to earn high salaries, lurking and seeking opportunities to penetrate sensitive systems, while continuously funneling substantial foreign currency revenues into the state regime.

According to official estimates from the United Nations, North Korea's IT labor ecosystem generates over $600 million annually for the regime. This vast underground shadow workforce has intricate and direct ties to the cryptocurrency ecosystem.

In many cases, these IT employees deliberately infiltrate Web3 and crypto institutions; at the same time, they extensively use cryptocurrency money laundering to obscure illegal fund flows. Last month, we detailed disclosure of a Russian and North Korean joint money laundering network sanctioned by the U.S. Treasury, which provides a financial laundering channel for North Korea's manipulated IT outsourcing system.

Figure: The money laundering pathway where victim enterprises pay salaries to North Korean IT employees, funneled through shell companies and Russian intermediaries for cashing out

Chainalysis closely tracks all cryptocurrency address entities related to North Korean IT worker fraud sanctions and deeply integrates open-source intelligence against this threat ecosystem.

North Korean IT technicians are usually stationed at overseas bases, where they use VPNs to obfuscate their network locations and employ stolen false identity credentials to apply for remote positions with global enterprises. Upon successful employment, these employees typically insist employers use stablecoins to pay their salaries.

We have already exposed such highly characterized on-chain activities, including in specific cases where on-chain monitoring probes captured typical features of wallets receiving fixed amounts of salaries monthly.

Figure: On-chain transaction detail records showing North Korean IT employees’ wallets receiving around $5,000 in salary regularly each month

Upon receipt of their salaries, North Korean IT personnel quickly transfer the cryptocurrency assets layer by layer to money laundering intermediaries, such as the aforementioned Russian and North Korean citizen money laundering network listed on the sanctions list.

How Chainalysis Tracks On-Chain Fund Flows

The major security incident at Binance comprehensively showcases how North Korean hackers continuously evolve, test, and refine their multi-dimensional coordinated cybercrime arsenals.

The same group of hackers can exploit recruitment platforms for social engineering breakthroughs, penetrate core corporate infrastructure, dispatch shadow employees to masquerade and infiltrate legitimate companies, and skillfully use cryptocurrency for covert money transfers of illicit gains.on.

As attack methods become increasingly sophisticated, enterprises and security agencies must not limit themselves to traditional network security perimeter defenses; rather, they must focus on monitoring the underlying financial flows and on-chain infrastructure that facilitate these transnational criminal operations.

Chainalysis is monitoring round-the-clock how North Korean hackers leverage the crypto ecosystem to generate income, aggregate and transfer illicit funds, and clean illegal proceeds.

Blockchain data intelligence plays a central role in such counteracting efforts. When on-chain analysis is deeply integrated with traditional network security defenses and threat intelligence, security teams and law enforcement agencies can accurately identify and urgently freeze stolen funds.

This comprehensive assessment capability not only helps create a full panorama of North Korea’s expanding on-chain financial networks but also detects its procurement and payment fund chains, providing strong on-chain forensic evidence for international sanction investigations and joint law enforcement.

The tracking investigation into the Binance theft case is still ongoing, and we expect that the stolen assets will continue to undergo on-chain splitting and transfer in the coming days. Chainalysis is fully cooperating with Binance and the entire crypto industry in conducting joint tracing, blocking subsequent money laundering channels, and striving to mitigate and reduce potential secondary losses.

Frequently Asked Questions

How did North Korean hackers steal as much as $6.4 billion from Binance?

The attack began with a fake job opportunity specifically targeting Binance employees. The attackers won the trust of the employee through multiple rounds of interviews arranged by a fictional company, before sending them a programming assignment that contained malicious code.

Once the employee downloaded and executed the test code, their computer was infected with a virus, which provided the hackers with their initial foothold into Binance's system. The attackers then deployed malware and used the victim's access to internal AI tools to progressively infiltrate the exchange's core business infrastructure.

What is the North Korean fake interview attack scam?

The North Korean fake interview scam refers to social engineering methods employed by hackers to exploit phony recruitment processes, infiltrating job seekers' personal computers, thereby gaining access to corporate sensitive systems or stealing cryptocurrency wallets.

Attackers typically disguise themselves as industry headhunters or recruitment managers, organizing seemingly formal and rigorous job interviews, and delivering Trojan payloads via malicious programming test questions or other downloadable attachments. Chainalysis collectively refers to such actions as “Contagious Interviews.”

Have North Korean hackers used fake interview techniques in other cryptocurrency attacks before?

Yes. In the past 18 months, Chainalysis has confirmed that over $14.3 million in losses have been directly linked to similar North Korean fake interview and malware scams.

Victims include individual cryptocurrency holders, independent private wallets, institutional entities, crypto protocols, and decentralized autonomous organizations (DAOs). These early attacks allowed North Korean hackers to fully test and refine their social engineering combat scripts before hunting for higher-value targets.

How do fake job interviews help North Korean hackers infiltrate corporate organizations?

Fake interviews allow attackers to directly gain access to the personal endpoint devices, login credentials, and internal network access permissions of target employees. Privileged employees with access to critical infrastructure are highly valuable targets for hackers, as breaching their accounts and devices can unlock lateral entry points into internal corporate systems for the attackers.

What is the North Korean illegal IT worker scam?

This refers to North Korean technicians disguising themselves as legitimate job seekers, typically using stolen false identification and various network obfuscation methods to apply for and obtain remote job positions with global enterprises.

They leverage this to earn high salaries, filling the state regime's coffers, and seeking to gain internal control over sensitive corporate systems. According to United Nations estimates, this gray ecosystem generates over $600 million annually for North Korea.

How does North Korea utilize cryptocurrency in its cybercrime activities?

North Korean-linked hacker groups receive illegal labor salaries through cryptocurrency and use it to transfer and launder the vast amounts of money stolen in network attacks. Outsourced laborers often require payments in stablecoins, which they then transfer to money laundering intermediary accounts.

Moreover, hackers skillfully utilize public chain networks to conceal control instructions for malware, thus establishing resilient and anti-censorship command and control (C2) relay infrastructure.

How does Chainalysis assist in tracking North Korean-related cybercrime?

Chainalysis conducts round-the-clock deep analysis of on-chain fund trajectories, accurately identifying the methods by which North Korean hackers and shadow entities receive, transfer, aggregate, and launder illicit funds.

This type of blockchain data intelligence can support security investigators and industry organizations in tracing the paths of stolen assets, pinpointing money laundering intermediary networks, providing evidence support for sanction compliance investigations, and working with ecosystem partners to urgently freeze stolen funds at critical junctures.