Cybersecurity specialists are increasingly attributing the massive $6.3 billion hack of Binance to North Korea. This incident is now considered the largest cryptocurrency theft ever recorded.
The methods employed by North Korean hackers are notably distinctive, and many believe their involvement is evident in the Binance breach.
Unlike many hacking groups, the North Korean approach often starts with a deceptive tactic aimed at gaining trust from employees.
Lisa Zhao, who oversees security operations at SlowMist, shared insights into these tactics. “Their strategy revolves around manipulating people rather than just exploiting code,” she explained.
In investigations conducted by SlowMist in 2025, attackers pretended to be project teams offering developers paid tasks to fix software issues. Some even provided upfront payments to build trust, while others posed as investors testing trading software.
The scheme’s real threat lay within the actual work. The attackers would alter legitimate software projects to introduce harmful code.
“In many instances we analyzed, no step appeared harmful on its own — it looked merely like offering assistance with debugging or altering some settings,” Zhao noted.
Even those who took steps to protect themselves were often outmaneuvered. Some employees utilized isolated environments to safeguard their systems, yet attackers would request minor changes that eroded this protection, allowing them greater access.
Once inside, the hackers could infiltrate the company’s network, steal login details, and navigate toward the systems managing financial assets, often camouflaging their activities using the company’s own tools.
Zhao observed connections between the stolen Binance assets and IP addresses linked to earlier thefts attributed to North Korean hackers.
“We found connections between funds taken from Binance and addresses tied to the Phemex hack in early 2025, which we had already associated with North Korean actors,” she stated.
TRM Labs, a blockchain intelligence firm, also attributed the attack to North Korea’s state-backed TraderTraitor operation, expressing strong confidence in their assessment and noting resemblances to prior heists.
What differentiates North Korean state-sponsored hackers from typical cybercriminals is their motive. While most hackers are driven by personal gain, North Korea’s operations are funded by and for the regime led by Kim Jong Un.
U.S. Treasury officials have linked North Korea’s cyber thievery to financing its weapons programs.
Zhao pointed out that the attackers exhibit strengths like patience and organization, alongside a sophisticated network for laundering stolen cryptocurrency.
“They have a robust money laundering framework… Rapidly moving funds between digital wallets and converting them into different cryptocurrencies makes it hard to track them down,” she added.
SlowMist’s founder, Yu Xuan, cautioned that North Korean hacking groups such as Lazarus Group, Bluenoroff, and Andariel utilize other countries as pathways to their targets, sometimes attacking U.S. systems first before aiming for European or Japanese targets.
“The widespread belief is that North Korea is impoverished and isolated, but these hacking entities can infiltrate systems belonging to individuals already situated in the United States to execute attacks,” he stated.
“Their operations are backed by the state, and they have numerous access points that allow them to reach any area globally.”
Adding to the challenge, experts indicate that AI can accelerate the preparation of these attacks, from crafting malicious code to streamlining delivery.
“A hacking group that previously targeted around five to ten entities over several months or a year could now focus on 50 to 100,” Xuan shared. He noted that many tasks, which were once done manually, can now be performed much more efficiently with AI technology.
Recently, Microsoft highlighted that several North Korean threat groups have started using AI in their operations, including crafting deceptive recruiting materials and developing malicious code.
Attackers often take advantage of employees’ reluctance to admit errors.
“Some victims actively deleted relevant records out of fear of accountability, which complicated the investigation and collection of evidence,” Zhao observed.
“I was more surprised by their manipulation of human nature than by their technical tactics.”
In response to inquiries, Binance did not confirm any North Korean involvement. The exchange noted it was collaborating with law enforcement to identify the perpetrators and affirmed that it would cover all losses incurred from the hack using company resources.
“Your assets are secured,” reassured co-CEO Richard Teng in a company statement.
