Mentioned in This Article
1. North Korea crypto hack methods: the Binance case as a template
A North Korea crypto hack has become the most feared kind of attack in the industry, and the theft of about $6.3 billion from Binance on October 29, 2026 shows why. Binance's account describes an operation that began with a fake job interview and ended with the takeover of an internal wallet signing service. Security researchers describe the methods behind it as five recurring techniques.
North Korean hackers are widely regarded as unusually effective at stealing digital assets. One estimate, from the security firm CertiK, attributes 60% of 2025's crypto losses to groups linked to the Democratic People's Republic of Korea (DPRK). The Binance case is alleged to be the work of such actors and is described as the largest crypto hack on record.
According to Binance's statement, the attack took roughly 20 minutes to carry out. That speed contrasts with the preparation behind it, which, in Binance's telling, started in September 2025. The five techniques below cover fake employees, fake job interviews, poisoned code libraries, attacks on infrastructure and the growing use of artificial intelligence.
The distinction between the attackers' preparation and the brief window of the theft is important for defenders. A long campaign of social engineering, meaning the manipulation of people into granting access, can sit quietly inside a company for months. The final theft then unfolds in minutes, leaving almost no time to react once the funds start moving.
2. How did the Binance attack unfold?
Binance says the attackers first compromised an engineer's work computer through a fake job interview. They then used an internal AI tool to take control of other engineers' computers and, with the credentials they obtained, hijacked an internal wallet signing service. These details come from Binance's own statement, published on November 3.
On October 29, according to the exchange, the attacker used stolen credentials to deploy a container and gain access to the internal wallet signing service. That access allowed transactions outside the normal withdrawal processes, meaning the funds could move without passing through the controls that govern customer withdrawals.
The attacker also made use of EIP-7702, an Ethereum feature that lets an account delegate execution to a smart contract. With it, an attacker-controlled contract gained partial control of a Binance hot wallet, which is a wallet kept online to handle day-to-day transfers. Binance said these authorizations stayed active even after it paused withdrawals. Because the wallet used multi-party computation, a setup in which the signing key is split among several parties, no single private key could revoke them quickly.
Each step in this chain depended on the one before it. A compromised developer machine yielded credentials, the credentials opened internal tools, and those tools gave access to the signing service that authorizes transactions. Breaking the chain at any point, for example by isolating developer machines from production systems, would have changed the outcome.
3. Fake employees: the most common route
Binance chief security officer Jimmy Su told Decrypt in August 2025 that the exchange rejects suspected North Korean résumés every day. At that time he said almost all the large DPRK hacks involved a fake employee. Su described the first-ranked method as placing an operative inside a company under a false identity.
Résumés from these applicants contain tell-tale signs, Su said, though Binance would not share specifics. Some applicants still reach interviews, where deepfakes alter their face and voice. His main clue is a slow internet connection, because the translation and voice-changing software introduces delays on calls.
Su added that North Korean workers are often top performers. One possible explanation he gave is that several people may share a single role across time zones, so the apparent employee seems tireless. Binance says its security team detected and prevented 57 suspected North Korea-linked threat cases in 2026, including fraudulent interviews and fake video conferencing apps.
The approach works because remote hiring is routine in the crypto industry, where many firms operate across time zones and rely on contractors. That openness is a strength for recruiting talent, and it is also what the fake-employee method exploits.
4. Fake job interviews aimed at existing staff
A second approach targets people who already work at crypto firms. Attackers pose as recruiters and claim a video or audio problem, then send a link to update Zoom that installs malware. Su said the group contacts external-facing staff while posing as a DeFi project or investment firm, offering high-paying jobs, two or three times normal pay, to lure them into interviews.
Binance says its own incident began in September 2025. A software engineer was contacted through a legitimate job platform by someone posing as a project director, who arranged two interviews. The first was a video call with a fake human resources representative, who built trust by sharing a social media account filled with personal photos. Binance described the approach as more advanced and deceptive than previously seen.
The second interview took place on a chat app and asked the engineer to download an assignment onto his work computer. The code contained unknown malware that replaced a legitimate developer tool with a malicious one, connected to an attacker's server and evaded Binance's security tools.
The tactic is not unique to this case. A North Korea-linked group known as WaterPlum, or Contagious Interview, infected at least 30,000 devices in more than 100 countries between about December 2025 and July 2026. It took funds or credentials from more than 7,000 wallets and moved about $10.71 million to North Korea. The group posed as AI, crypto or NFT companies and assigned coding tasks that required downloading malicious files, and some used face-swapping software and blamed poor connections.
5. Poisoned code libraries
Su ranked library poisoning as the second most common North Korean method, after fake employees. Developers build software from reusable open-source packages, such as those distributed through NPM. Attackers clone a package and add a few malicious lines while keeping its original function, so the malware spreads as other programs build on the altered code.
In September 2025, the security firm ReversingLabs found two NPM packages that used Ethereum smart contracts to download malware, a technique it had not seen before. The packages were linked to GitHub repositories, mostly marketed as crypto trading bots, with thousands of commits and stars that the firm believes were mostly fake. Binance has previously called such activity a sophisticated campaign and linked it to North Korea.
Su said Binance has staff review NPM libraries closely. Even so, a member of the company's wallet DevOps team installed a tampered copy of Homebrew in June 2026 while trying to set up an AI coding tool found through a search engine. Security caught the problem, replaced his device and rotated his credentials, but colleagues on the wallet infrastructure team had been exposed.
The comparison with Bybit also shows how attention among defenders has shifted. After 2025, many firms reviewed their dependence on outside wallet providers. The Binance case suggests that scrutiny of internal signing services and developer environments deserves equal priority.
6. Attacks on infrastructure
The previous record for a crypto theft was Bybit's loss of $1.4 billion in February 2025. Security firms linked that attack to North Korea, which injected malicious code into Safe, the wallet provider Bybit used. How the code was injected was unclear. Bybit said its own infrastructure was not compromised and that the attack came through the third party.
The Binance case differs in an important way: it targeted the exchange's own systems rather than a vendor's. That shift means a company cannot rely on outsourced tools being the only weak point, and it must secure internal signing services, developer machines and the credentials that connect them.
Taken together, the two cases show the same attackers using different entry points. In one, the route ran through a third-party wallet product. In the other, it ran through an employee, a stolen credential and a service the exchange operated itself.
7. Can AI make these attacks more convincing?
Yes, in the view of the security experts quoted, because AI can make every method described above more effective. Deepfakes can strengthen fake interviews, and automated tools can polish the messages and code used in lures. Su said AI tools increase attack effectiveness, and Google warned earlier in 2026 of an AI-powered North Korean malware campaign targeting crypto and DeFi firms.
The article also points to a more distant concern. In October, Ethereum co-founder Vitalik Buterin said it is plausible that AI could break encryption within two years, and experts urged the industry to prepare for AI-driven encryption attacks. There are no confirmed reports of North Korean hackers using AI to break encryption, so this remains a possibility to plan for rather than an observed event.
8. What defenders can take from the case
The common thread across the five methods is that the first step usually targets a person, not a cryptographic system. A believable recruiter, a request to run a coding test or a prompt to update video software can open the door long before any wallet is touched. Controls aimed at people and their devices therefore carry as much weight as those protecting keys.
Binance's own measures, as Su described them, include rejecting suspect résumés daily, watching for connection delays in interviews and reviewing open-source libraries by hand. The exchange also reports blocking 57 suspected North Korea-linked cases in 2026. The October 29 theft shows that such defenses are not infallible, which is why layered controls on signing services and delegated authorizations matter.
What happens next will depend on investigations into the stolen funds and on whether other exchanges adopt similar safeguards. For now, the case gives the industry a detailed, if still partial, record of how a determined state-linked group moves from a job offer to a multibillion-dollar theft.