Cybersecurity consultants are pointing the finger at North Korea being behind the $6.3 billion Binance hack.
The Hermit Kingdom’s hackers have a distinctive means of working, and their fingerprints are all over the Binance heist — already hailed as the largest cryptocurrency theft in historical past.
North Korean chief Kim Jong Un attends a drone exhibition in Kangwon Province on Oct. 29, 2026. State-backed North Korean hackers are suspected in the $6.3 billion Binance heist. KCNA VIA KNS/AFP via Getty Images
North Korean chief Kim Jong Un, proper, and his daughter stand with troopers in a picture launched by KCNA on Nov. 27, 2022. Hackers working for his regime are suspected in the $6.3 billion Binance heist. KCNA VIA KNS/AFP via Getty Images
Unlike the majority of hacking teams, North Koreans opening transfer is usually a confidence trick aimed at an worker.
“They attack people, not code,” Lisa Zhao, security operation lead at cybersecurity firm SlowMist instructed The Post.
In investigations SlowMist performed in 2025, attackers posed as project groups and supplied builders paid work fixing software program. Some supplied money upfront to set up trust, others introduced themselves as traders with trading software program to check.
Lisa Zhao, security operation lead at SlowMist, says North Korean hackers “attack people, not code,” utilizing paid work and seemingly innocent requests to win staff’ trust. Courtesy of Lisa Zhao
Their lure was hidden in the work itself. Attackers modified a actual, publicly obtainable software program project and added malicious code.
“In many of the cases we encountered, no individual step looked like an attack — just helping with debugging, testing some code or changing a setting.”
An FBI needed discover for alleged Lazarus hacker Park Jin Hyok in 2018. The North Korean community has been linked to main cryptocurrency thefts. Federal Bureau of Investigation
Even staff who took precautions could be manipulated. Some ran the software program in an remoted setting to defend the relaxation of their laptop.
But then attackers requested for a seemingly cheap adjustment to get their project working, which weakened that safety and gave them larger control, Zhao said.
From there, the hackers can make their means into their supposed company’s community, steal credentials and get nearer to the systems controlling its money, at this level utilizing the company’s own instruments to help disguise their exercise.
A person makes use of a laptop computer in a 2020 file picture. North Korean hackers use paid work gives to trick builders into working malicious software program, investigators say. ryanking999 – stock.adobe.com
Zhao said her crew noticed hyperlinks between the stolen Binance funds and IP addresses related with earlier North Korea thefts.
“We detected links between the Binance hackers’ funds and addresses involved in the Phemex theft in early 2025, which we already linked to North Korean hackers,” Zhao instructed The Post.
Blockchain intelligence firm TRM Labs individually attributed the attack to North Korea’s state-backed TraderTraitor operation, with high confidence, also citing similarities to earlier heists.
What units North Korea’s state-backed hackers aside from extraordinary cybercriminals is their mission. Other hackers steal for themselves, but the North Korea steals for the regime, headed by Supreme Leader Kim Jong Un.
A hacker in a 2016 file picture. AI can help North Korean hacking teams write malicious code and goal more corporations, cybersecurity consultants say. TaylerDerden – stock.adobe.com
US Treasury officers have linked North Korea’s cyber theft to funding its weapons packages.
Zhao says the attackers’ strengths mix endurance, group and an established capability to transfer and launder stolen cryptocurrency.
“Their money laundering infrastructure is well developed… They move the funds fast between digital wallets and swap it to other cryptocurrencies, making it very difficult to stop them,” she said.
SlowMist founder Yu Xuan warned North Korean hack teams — such as Lazarus Group, Bluenoroff, and Andariel, according to feds — use other nations as gateways to their targets, for instance hacking into a US system, then going from there to goal Europe or Japan.
“The common perception of North Korea is that it is poor and cut off from the world, but these kinds of hacking groups can [get into] computers belonging to people already in the United States to carry out attacks,” he said.
North Korean chief Kim Jong Un attends a drone exhibition and weapons demonstration in North Korea on Oct. 29, 2026. Hackers working for his regime are suspected in the $6.3 billion Binance heist. via REUTERS
“The activity is supported by the state, and their network can still have many stepping stones that allow it to reach any corner of the world.”
To make issues worse — AI can make the work behind those attacks sooner and cheaper, from writing malicious code to getting ready its supply.
“A hacking group that might previously have focused on roughly five to 10 targets over six months or a year might now be able to focus on 50 to 100,” Xuan said. “Many things that previously required manually writing code or people carrying out repetitive tasks can now be done much more efficiently with AI.”
Microsoft’s New York workplace in May 2025. The company warns North Korean hackers are utilizing AI to pretend identities and develop malicious code. Getty Images
Microsoft reported this week that several North Korean risk teams had included AI into operations, including misleading recruiting materials, fabricated identities and malicious-code development.
Attackers can also exploit staff’ concern of admitting a mistake.
“Some employees who had been deceived would actively delete relevant records because they were afraid of being held responsible. They would also fail to report the incident promptly, making investigation and evidence collection very difficult,” Zhao said.
Binance founder Changpeng Zhao at Viva Technology in Paris in June 2022. The exchange has pledged to cowl all losses from the $6.3 billion heist. REUTERS
“That exploitation of human nature surprised me more than their technical methods.”
Binance did not confirm North Korean involvement in its response to The Post. The company has said it is working with law enforcement to determine the criminals and will cowl all hacked losses with company funds.
“Your assets are safe,” co-CEO Richard Teng said in a assertion provided by the company.
Source hyperlink
