Five Ways North Korea Breaks Into Crypto Firms—and How Binance Was Hacked

Hackers from North Korea are notoriously effective at stealing crypto, with one estimate attributing 60% of all losses last year to DPRK-linked groups. These hackers enlist several different vectors of attack, making it all the more difficult to spot them in the act.

Last week, it took just 20 minutes for alleged North Korean hackers to drain $6.3 billion from Binance, in what is the biggest crypto hack on record. The attackers compromised a Binance engineer's work computer through a fake job interview, used an internal AI tool to gain control of other engineers' computers, and then used stolen credentials to hijack an internal wallet signing service, the exchange said.

In the past, North Korean hackers have been known to get hired at crypto companies under fake identities, attack through third-party infrastructure, and poison widely used code libraries. More recently, they've started using AI to make all of it more convincing.

Here are some examples of the methods that North Korean hackers are known to use in crypto attacks.

Fake employees

Binance chief security officer Jimmy Su told Decrypt in August 2025 that the exchange throws out suspected North Korean resumes every day, and that "almost all the large DPRK hacks," at the time, had involved a fake employee helping facilitate the attack.

Su said there were tell-tale signs in resumes that indicate the applicant was from North Korea, but the exchange was not willing to reveal the specifics on the red flags. Sometimes, though, malicious actors get through to the interview stage, where the attackers use deepfakes to change their face and voice.

"The only real good detection is that they almost always have a slow internet connection," he told Decrypt. "What's happening is that the translation and the voice changer are working during the call … that's why they are always delayed."

Those who do get hired tend to be suspiciously good at the job. Su said North Korean workers are often among a company's top performers, likely because several people may be sharing one role across time zones.

The threat has not let up. Binance said its security team detected and prevented 57 suspected North Korea-linked cyber threat cases in 2026, using techniques ranging from fraudulent job interviews to fake video conferencing apps.

Fake job interviews

Attackers also flip the scam around and pose as recruiters to target people who already work at high-profile crypto companies. Often, the attacker will claim there's a video or audio issue during the interview and send the victim a link to update Zoom, which infects their device with malware

"The DPRK group will [also] try to schedule calls with the external-facing employees," Su told Decrypt. "Either as a DeFi project or investment firm. Worst yet, they'll be recruiting them for a high-level job, paying twice, three times as much, just to get them onto an interview."

This is how the Binance attack began, according to the exchange. In September, a Binance software engineer was approached through a legitimate job-hunting platform by someone posing as a project director, who set up two interviews. In the first, a purported HR representative built trust over a live video call by sharing a social media account full of personal photos and videos, an approach Binance called "more advanced and deceptive than previously seen."

In the second, held on a chat app, the engineer was told to download an "assignment" onto his work computer. The code repository contained previously unknown malware that ran during setup, swapped a legitimate developer tool for a malicious version and connected to an attacker-controlled server, evading Binance's security tools.

One North Korea-linked group infected at least 30,000 devices in more than 100 countries between roughly December 2025 and July 2026 using similar methods. It took funds or credentials from more than 7,000 crypto wallets and moved around $10.71 million to North Korea.

The group, known as WaterPlum or Contagious Interview, posed as AI, crypto, or NFT companies and set candidates a technical interview or coding task that required downloading malware-filled files. Some used AI face-swapping software during interviews before cutting their video and asking the candidate to do the same, blaming a bad connection.

Library poisoning

Binance's Su also told Decrypt that North Korean hackers poison public code libraries, ranking it as the second most common method of attack—behind fake employees.

Node Package Manager (NPM) packages are collections of reusable, open-source code that developers frequently use. Attackers can clone these packages and slip in a small line of malicious code while keeping its original function. That means that a victim could use this poisoned code library and not notice, with the malicious code embedding itself deeper over time as more is built on top of it.

In September 2025, software security firm ReversingLabs found two NPM packages that used Ethereum smart contracts to download malware, which the firm said it hadn't seen before. The packages were tied to a wider network of GitHub repositories, mostly branded as crypto trading bots, with thousands of commits and stars that ReversingLabs thinks were mostly faked.

The tactic formed part of a “sophisticated campaign” of malicious actors attempting to hack users via poisoned blockchain-related public code libraries, a vector of attack that Binance has previously attributed to North Korean hackers.

To counter the threat, Su said, Binance makes employees go through NPM libraries with a fine-tooth comb.

Tampered developer tools also played a part in the Binance hack. In June, a member of Binance's wallet DevOps team downloaded a tampered installation of Homebrew, a popular software installer, while trying to install an AI coding tool he had found through a search engine, the exchange said. Its security team caught the problem, replaced the device and rotated his credentials, but the incident exposed the engineer and his colleagues on the wallet infrastructure team to the attackers.

Infrastructure attacks

Before Binance, the unwanted record for the largest crypto hack belonged to Bybit, which lost $1.4 billion in February 2025. Cybersecurity firms revealed that North Korean hackers pulled off the attack by planting malicious code into the infrastructure of Safe—a crypto wallet provider used by the exchange.

The security firms said malicious JavaScript code was directly injected into Safe's online infrastructure. Though, it was unclear how the attackers managed to do this.

Bybit's infrastructure "was not compromised," the exchange told Decrypt, and the hack came purely because a third party was exploited.

The Binance attack targeted the exchange's own systems. On October 29, the attacker used stolen credentials to deploy a container and gain unauthorized access to an internal wallet signing service, which let it initiate transactions outside Binance's normal withdrawal process. On Ethereum, it used the signing service to exploit EIP-7702, a mechanism that lets an account delegate execution rights to a smart contract, giving an attacker-controlled contract partial control over a Binance hot wallet.

Those on-chain authorizations kept working even after Binance suspended withdrawals. Because the hot wallet used multi-party computation, there was no single private key Binance could use to revoke them quickly, the exchange said.

AI-powered scams

Every single one of the above mentioned attack vectors can be turbo-charged with artificial intelligence tools.

Early this year, Google warned of an AI-powered malware campaign targeting crypto companies coming from North Korea. Similarly, Binance's Su also mentioned that AI tools can be used to increase the effectiveness of attacks.

Concerns around AI-powered hacks have risen in recent months, with Ethereum co-founder Vitalik Buterin saying in October that it's "plausible" AI could break encryption within the next two years. It came amid an explosion in AI-driven maths, with OpenAI claiming to have cracked a 90-year-old maths problem in a matter of days. Experts urged the industry to prepare for AI-powered attacks on encryption.

There are no confirmed reports of North Korean hackers using AI to break encryption. But given how quickly they've adopted AI elsewhere, the industry may have to prepare for that next.