Inside the $6.3 Billion Binance Hack: How North Korea Infiltrates Crypto Firms

North Korea-linked hackers drained $6.3 billion from Binance in just 20 minutes last week, according to the exchange, making it the largest crypto hack on record. Binance said the attackers compromised an engineer's work computer through a fake job interview, used an internal AI tool to take control of other engineers' machines, and then used stolen credentials to hijack an internal wallet signing service.

The attack's anatomy, as described by Binance, shows how far the DPRK playbook has evolved. One estimate attributes 60% of all crypto losses last year to North Korea-linked groups, and their methods now span hiring fraud, supply-chain poisoning, third-party infrastructure compromise and AI-assisted deception.

How did the Binance attack unfold?

According to the exchange, a Binance software engineer was approached in September through a legitimate job-hunting platform by someone posing as a project director, who arranged two interviews. In the first, a purported HR representative built trust over live video by sharing a social media account full of personal photos and videos — an approach Binance called "more advanced and deceptive than previously seen."

The second interview, held on a chat app, required the engineer to download an "assignment" onto his work computer. The code repository contained previously unknown malware that ran during setup, swapped a legitimate developer tool for a malicious version and connected to an attacker-controlled server, evading Binance's security tools.

The final stage came on October 29. The attacker used stolen credentials to deploy a container and gain unauthorized access to the internal wallet signing service, initiating transactions outside Binance's normal withdrawal process. On Ethereum, the attacker exploited EIP-7702 — a mechanism that lets an account delegate execution rights to a smart contract — giving an attacker-controlled contract partial control over a Binance hot wallet.

Those on-chain authorizations kept working even after Binance suspended withdrawals. Because the hot wallet used multi-party computation, there was no single private key Binance could use to revoke them quickly, the exchange said.

What role do fake employees play?

Binance chief security officer Jimmy Su told Decrypt in August 2025 that the exchange discards suspected North Korean resumes every day, and that "almost all the large DPRK hacks" at that time had involved a fake employee facilitating the attack.

Resumes carry tell-tale signs, though Binance declined to detail the red flags. At the interview stage, attackers deploy deepfakes to alter face and voice. "The only real good detection is that they almost always have a slow internet connection," Su said. "What's happening is that the translation and the voice changer are working during the call … that's why they are always delayed."

Those who get hired tend to be suspiciously strong performers — likely, Su said, because several people share one role across time zones. Binance said its security team detected and prevented 57 suspected North Korea-linked cyber threat cases in 2026, using techniques ranging from fraudulent job interviews to fake video conferencing apps.

The recruiter scam also runs in reverse: attackers posing as recruiters target staff at high-profile crypto firms, claiming video problems and sending a fake Zoom update link that installs malware. "They'll be recruiting them for a high-level job, paying twice, three times as much, just to get them onto an interview," Su said.

One North Korea-linked group, known as WaterPlum or Contagious Interview, infected at least 30,000 devices across more than 100 countries between roughly December 2025 and July 2026 using these methods. It drained funds or credentials from more than 7,000 crypto wallets and moved around $10.71 million to North Korea, posing as AI, crypto or NFT companies and setting coding tasks that required downloading malware-filled files. Some used AI face-swapping software during interviews before cutting video and blaming a bad connection.

What is library poisoning?

Su ranked poisoned public code libraries as the second most common DPRK attack vector, behind fake employees. Attackers clone NPM packages — collections of reusable open-source code — and slip in a small line of malicious code while keeping the original function intact, letting it embed deeper as more code builds on top.

In September 2025, security firm ReversingLabs found two NPM packages that used Ethereum smart contracts to download malware, a technique the firm had not seen before. The packages were tied to a network of GitHub repositories branded as crypto trading bots, with thousands of commits and stars ReversingLabs believes were mostly faked. Binance now screens NPM libraries with a fine-tooth comb, Su said.

Tampered developer tools also factored into the Binance hack. In June, a wallet DevOps team member downloaded a tampered Homebrew installation while trying to install an AI coding tool found via a search engine. Binance's security team caught it, replaced the device and rotated credentials — but the incident exposed the engineer and his wallet infrastructure colleagues to the attackers.

What about infrastructure attacks?

Before Binance, the record hack belonged to Bybit, which lost $1.4 billion in February 2025 after North Korean hackers injected malicious JavaScript into the infrastructure of Safe, a third-party wallet provider. Bybit's own infrastructure "was not compromised," the exchange told Decrypt.

Unlike Bybit, the Binance attack hit the exchange's own systems directly — and exploited a delegation feature of Ethereum's account model to keep authorizations alive even during an incident response.

Is AI raising the stakes?

Google warned early this year of an AI-powered malware campaign targeting crypto companies from North Korea, and Su said AI tools increase attack effectiveness. Ethereum co-founder Vitalik Buterin said in October it is "plausible" AI could break encryption within two years, a warning that came as OpenAI claimed to have cracked a 90-year-old maths problem in days. There are no confirmed reports of North Korean hackers using AI to break encryption — but their rapid adoption of AI everywhere else means the industry may need to prepare for exactly that next.