Five Ways North Korea Breaks Into Crypto Firms—and How Binance Was Hacked

In brief

• North Korean hackers allegedly drained $6.3 billion from Binance last week, the largest crypto hack on record.
• Their methods range from getting hired under fake identities to poisoning code libraries and compromising third-party wallet infrastructure.
• AI is making these attacks more convincing, with deepfakes already showing up in fake interviews.

Hackers from North Korea are notoriously effective at stealing crypto, with one estimate attributing 60% of all losses last year to DPRK-linked groups. These hackers enlist several different vectors of attack, making it all the more difficult to spot them in the act.

Last week, it took just 20 minutes for alleged North Korean hackers to drain $6.3 billion from Binance, in what is the biggest crypto hack on record. The attackers compromised a Binance engineer's work computer through a fake job interview, used an internal AI tool to gain control of other engineers' computers, and then used stolen credentials to hijack an internal wallet signing service, the exchange said.

In the past, North Korean hackers have been known to get hired at crypto companies under fake identities, attack through third-party infrastructure, and poison widely used code libraries. More recently, they've started using AI to make all of it more convincing.