Cybersecurity experts are pointing the finger at North Korea being behind the $6.3 billion Binance hack.
The Hermit Kingdom’s hackers have a distinctive way of operating, and their fingerprints are all over the Binance heist — already hailed as the largest cryptocurrency theft in history.
Unlike the majority of hacking groups, North Koreans opening move is often a confidence trick aimed at an employee.
KCNA VIA KNS/AFP via Getty Images
“They attack people, not code,” Lisa Zhao, security operation lead at cybersecurity firm SlowMist told The Post.
In investigations SlowMist conducted in 2025, attackers posed as project teams and offered developers paid work fixing software. Some offered money upfront to establish trust, others presented themselves as investors with trading software to test.
Their trap was hidden in the work itself. Attackers modified a real, publicly available software project and added malicious code.
“In many of the cases we encountered, no individual step looked like an attack — just helping with debugging, testing some code or changing a setting.”
Even employees who took precautions could be manipulated. Some ran the software in an isolated environment to protect the rest of their computer.
But then attackers asked for a seemingly reasonable adjustment to get their project working, which weakened that protection and gave them greater control, Zhao said.
From there, the hackers can make their way into their intended company’s network, steal credentials and get closer to the systems controlling its money, at this point using the company’s own tools to help disguise their activity.
Zhao said her team observed links between the stolen Binance funds and IP addresses associated with earlier North Korea thefts.
“We detected links between the Binance hackers’ funds and addresses involved in the Phemex theft in early 2025, which we already linked to North Korean hackers,” Zhao told The Post.
Blockchain intelligence firm TRM Labs separately attributed the attack to North Korea’s state-backed TraderTraitor operation, with high confidence, also citing similarities to earlier heists.
What sets North Korea’s state-backed hackers apart from ordinary cybercriminals is their mission. Other hackers steal for themselves, but the North Korea steals for the regime, headed by Supreme Leader Kim Jong Un.
US Treasury officials have linked North Korea’s cyber theft to funding its weapons programs.
Zhao says the attackers’ strengths combine patience, organization and an established ability to move and launder stolen cryptocurrency.
“Their money laundering infrastructure is well developed… They move the funds fast between digital wallets and swap it to other cryptocurrencies, making it very difficult to stop them,” she said.
SlowMist founder Yu Xian warned North Korean hack groups — such as Lazarus Group, Bluenoroff, and Andariel, according to feds — use other countries as gateways to their targets, for example hacking into a US system, then going from there to target Europe or Japan.
“The common perception of North Korea is that it is poor and cut off from the world, but these kinds of hacking groups can [get into] computers belonging to people already in the United States to carry out attacks,” he said.
“The activity is supported by the state, and their network can still have many stepping stones that allow it to reach any corner of the world.”
