Five Ways North Korea Breaks Into Crypto Firms—and How Binance Was Hacked

What it is

Decrypt's account of the alleged North Korean theft of $6.3 billion from Binance, which it calls the largest crypto hack on record. The money was drained in about 20 minutes, according to the article. The attack chain comes from Binance's own statement of 3 November 2026. The article adds detection signals and related campaigns drawn from Binance chief security officer Jimmy Su's earlier comments to Decrypt (August 2025).

How it works

Binance's account of the intrusion, in order:

1. In September 2026, a Binance software engineer was approached on a legitimate job-hunting platform by someone posing as a project director. Two interviews followed. In the first, a purported HR representative built trust on a live video call. In the second, on a chat app, the engineer was told to download an "assignment" onto their work computer.
2. The repository contained previously unknown malware that ran during setup. It swapped a legitimate developer tool for a malicious one and connected to an attacker-controlled server, evading Binance's security tools.
3. The attackers used an internal AI tool to gain control of other engineers' computers.
4. On 29 October 2026, stolen credentials were used to deploy a container and reach an internal wallet signing service. That let the attacker start transactions outside Binance's normal withdrawal process.
5. On Ethereum, the attacker used the signing service to exploit EIP-7702, which lets an account delegate execution to a smart contract. An attacker-controlled contract gained partial control of a Binance hot wallet.

A separate incident in June 2026 exposed the wallet infrastructure team earlier. A wallet DevOps team member installed a tampered Homebrew while looking for an AI coding tool through a search engine. Binance caught it, replaced the device and rotated the credentials, but the engineer and colleagues had already been exposed to the attackers.

Preconditions / Affected

• Staff with access to wallet infrastructure who can be reached by recruiters on public job platforms, and who run code on work machines.
• A hot wallet on multi-party computation (MPC). Binance says the EIP-7702 authorizations kept working after it suspended withdrawals, and no single private key existed to revoke them quickly.

What to do

The page gives few prescriptions. These are the ones it states or reports:

• Treat a "video or audio issue" followed by a link to "update Zoom" as a malware delivery pattern.
• Watch for lagging audio and video on interview calls. Su called a slow internet connection the one good detection for deepfaked candidates, because translation and voice changing run during the call.
• Be suspicious of new hires who are unusually strong performers. Su says several people may be sharing one role across time zones.
• Review NPM dependencies closely. Binance requires this of its employees. Su ranks library poisoning as the second most common North Korean method, after fake employees.
• Do not run recruiter-supplied code on a work computer. This is inferred from the attack chain, not stated as advice by the page.

Caveats

• The attribution to North Korea and the $6.3 billion figure are described as alleged. The details of the intrusion come from Binance alone.
• Binance did not disclose the red flags it uses to screen resumes.
• The article does not say how the internal AI tool was abused or how the credentials were stolen.
• For Bybit's $1.4 billion loss in February 2025, security firms say malicious JavaScript was injected into the infrastructure of Safe, but it is unclear how. Bybit says its own infrastructure was not compromised.
• Related figures: Binance says it blocked 57 suspected North Korea-linked cases in 2026. The WaterPlum (Contagious Interview) group infected at least 30,000 devices in more than 100 countries between about December 2025 and July 2026, and moved around $10.71 million to North Korea.
• In September 2025, ReversingLabs found two NPM packages that used Ethereum smart contracts to download malware.
• There are no confirmed reports of North Korean hackers using AI to break encryption.