North Korean hackers allegedly drained $6.3 billion from Binance last week in what is the largest crypto hack on record. The attack took just 20 minutes, according to the exchange, and involved compromising an engineer's work computer through a fake job interview, using an internal AI tool to gain control of other engineers' computers, and then using stolen credentials to hijack an internal wallet signing service.
One estimate attributes 60% of all crypto losses last year to North Korea-linked groups. These hackers employ several different attack vectors, making them difficult to detect. Here are some of the methods they are known to use.
Fake employees
Binance chief security officer Jimmy Su told Decrypt in August 2025 that the exchange discards suspected North Korean resumes every day, and that "almost all of the large DPRK hacks" at the time had involved a fake employee helping facilitate the attack. Su said there are tell-tale signs in resumes indicating an applicant is from North Korea, but the exchange would not reveal the specifics.
Sometimes attackers reach the interview stage, where they use deepfakes to alter their face and voice. "The only real good detection is that they almost always have a slow internet connection," Su said. "What's happening is that the translation and the voice changer are working during the call … that's why they are always delayed."
Those who do get hired tend to be suspiciously good at the job. Su said North Korean workers are often among a company's top performers, likely because several people may share one role across time zones. Binance said its security team detected and prevented 57 suspected North Korea-linked cyber threat cases in 2026, using techniques ranging from fraudulent job interviews to fake video conferencing apps.
Fake job interviews
Attackers also pose as recruiters to target employees at high-profile crypto companies. Often, the attacker claims there is a video or audio issue during the interview and sends the victim a link to update Zoom, which infects their device with malware.
"The DPRK group will [also] try to schedule calls with the external-facing employees," Su told Decrypt. "Either as a DeFi project or investment firm. Worst yet, they'll be recruiting them for a high-level job, paying twice, three times as much, just to get them onto an interview."
This is how the Binance attack began, according to the exchange. In September, a Binance software engineer was approached through a legitimate job-hunting platform by someone posing as a project director, who set up two interviews. In the first, a purported HR representative built trust over a live video call by sharing a social media account full of personal photos and videos—an approach Binance called "more advanced and deceptive than previously seen." In the second, held on a chat app, the engineer was told to download an "assignment" onto his work computer. The code repository contained previously unknown malware that ran during setup, swapped a legitimate developer tool for a malicious version, and connected to an attacker-controlled server, evading Binance's security tools.
One North Korea-linked group infected at least 30,000 devices in more than 100 countries between roughly December 2025 and July 2026 using similar methods. It took funds or credentials from more than 7,000 crypto wallets and moved around $10.71 million to North Korea. The group, known as WaterPlum or Contagious Interview, posed as AI, crypto, or NFT companies and set candidates a technical interview or coding task that required downloading malware-filled files. Some used AI face-swapping software during interviews before cutting their video and asking the candidate to do the same, blaming a bad connection.
Library poisoning
Binance's Su also told Decrypt that North Korean hackers poison public code libraries, ranking it as the second most common method of attack—behind fake employees. Node Package Manager (NPM) packages are collections of reusable, open-source code that developers frequently use. Attackers can clone these packages and slip in a small line of malicious code while keeping the original function. A victim could use the poisoned code library without noticing, with the malicious code embedding itself deeper over time as more is built on top of it.
In September 2025, software security firm ReversingLabs found two NPM packages that used Ethereum smart contracts to download malware, which the firm said it hadn't seen before. The packages were tied to a wider network of GitHub repositories, mostly branded as crypto trading bots, with thousands of commits and stars that ReversingLabs thinks were mostly faked. The tactic formed part of a "sophisticated campaign" of malicious actors attempting to hack users via poisoned blockchain-related public code libraries, a vector Binance has previously attributed to North Korean hackers. To counter the threat, Su said, Binance makes employees go through NPM libraries with a fine-tooth comb.
Tampered developer tools also played a part in the Binance hack. In June, a member of Binance's wallet DevOps team downloaded a tampered installation of Homebrew, a popular software installer, while trying to install an AI coding tool he had found through a search engine, the exchange said. Its security team caught the problem, replaced the device, and rotated his credentials, but the incident exposed the engineer and his colleagues on the wallet infrastructure team to the attackers.
Infrastructure attacks
Before Binance, the unwanted record for the largest crypto hack belonged to Bybit, which lost $1.4 billion in February 2025. Cybersecurity firms revealed that North Korean hackers pulled off the attack by planting malicious code into the infrastructure of Safe—a crypto wallet provider used by the exchange. The security firms said malicious JavaScript code was directly injected into Safe's online infrastructure, though it was unclear how the attackers managed to do this. Bybit's infrastructure "was not compromised," the exchange told Decrypt, and the hack came purely because a third party was exploited.
The Binance attack targeted the exchange's own systems. On October 29, the attacker used stolen credentials to deploy a container and gain unauthorized access to an internal wallet signing service, which let it initiate transactions outside Binance's normal withdrawal process. On Ethereum, it used the signing service to exploit EIP-7702, a mechanism that lets an account delegate execution rights to a smart contract, giving an attacker-controlled contract partial control over a Binance hot wallet. Those on-chain authorizations kept working even after Binance suspended withdrawals. Because the hot wallet used multi-party computation, there was no single private key Binance could use to revoke them quickly, the exchange said.
AI-powered scams
Every one of the above attack vectors can be enhanced with artificial intelligence tools. Early this year, Google warned of an AI-powered malware campaign targeting crypto companies coming from North Korea. Similarly, Binance's Su mentioned that AI tools can be used to increase the effectiveness of attacks.
Concerns around AI-powered hacks have risen in recent months, with Ethereum co-founder Vitalik Buterin saying in October that it's "plausible" AI could break encryption within the next two years. It came amid an explosion in AI-driven maths, with OpenAI claiming to have cracked a 90-year-old maths problem in a matter of days. Experts urged the industry to prepare for AI-powered attacks on encryption. There are no confirmed reports of North Korean hackers using AI to break encryption, but given how quickly they've adopted AI elsewhere, the industry may have to prepare for that next.
