North Koreans Seen as Likely Hackers in Massive Binance Heist

The record-setting $6.3 billion hack of Binance, the world’s biggest cryptocurrency exchange, has been blamed on alleged North Korean hackers, who have become infamous for preying on the digital-asset industry.

North Korean hackers have been accused by the FBI and cybersecurity experts of some of the biggest crypto heists in recent years, including the $1.5 billion Bybit attack last year and the 2022 theft of about $620 million in cryptocurrency.”

Now, some security experts believe North Korean hackers have incorporated powerful artificial intelligence tools into their arsenal, based on the complexity and precision of recent attacks. Specifically, the hackers are believed to be using AI models for the reconnaissance and social engineering phases of their attacks — two areas that are among common stages where malicious actors are adopting AI software.

Large language models and other AI tools can be highly useful in scanning a target’s computer network and publicly available rosters of employees and contractors to look for any potential weak points, and then in helping craft phishing attacks tailored to those individuals.

This was the assessment in a report in April from TRM Labs, a blockchain intelligence firm that tracks cryptocurrency thefts, which found that suspected North Korean hackers were responsible for more than three-quarters of all crypto hacking losses since the start of the year.

Whereas many past attacks attributed to suspected North Korean hackers involved “simple private key compromises,” the latest attacks have “required weeks of targeted manipulation of complex blockchain mechanisms,” a change in tactics that suggested the hackers are improving their ability to more precisely target their attacks potentially with the help of AI and other techniques, including in-person meetings with hacking targets, the firm wrote.

“This is an inflection point and this attack is unprecedented,” Ari Redbord, global head of policy and government affairs at TRM Labs, said Friday.

Brian Peretti, the former chief technology officer at the U.S. Department of the Treasury, said he expects hackers to carry out more audacious breaches that link together vulnerabilities to get at highly-secured targets with the help of AI. However, he said, unlike cryptocurrency wallets, U.S. bank deposits are protected not just by technical measures but by layers of checks and controls required by regulation. These measures apply to financial institutions on the sending and receiving end of a transaction and are meant to stop suspicious money moves and make them traceable, he said.

“I don’t know how you can move $6 billion out of a bank,” said Peretti, who now runs the cybersecurity consultancy Everstream Advisors. “On the blockchain it’s a lot easier.”

Read More: North Korea’s $1.5 Billion Heist Puts the Crypto World on Notice

The Binance incident is the latest setback for an industry that’s seeking a greater role in traditional finance and has enjoyed a friendly regulatory environment under US President Donald Trump, despite a long history of mega-hacks that have undermined confidence in the ability of the exchanges to protect themselves from increasingly sophisticated cyberattacks.

TRM Labs attributed the Binance hack to TraderTraitor, an elite North Korean hacking unit that the FBI previously blamed for the Bybit hack. The country’s hackers have been ramping up their attacks this year, Redbord added, noting attacks on the KelpDAO decentralized-finance protocol and a derivatives exchange called Drift Protocol.

“In one evening, North Korea took around what they stole over the previous six years combined,” Redbord said.

Chainalysis Chief Executive Officer Jonathan Levin also said in a post on X that TraderTraitor had likely carried out the Binance attack.

While much remains unknown about the attack, hackers are believed to have compromised a software engineer’s laptop, which gave them the ability to move into the exchange’s systems for processing withdrawals, among “additional points of breach,” the company said. “This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it,” Binance said in a post on X.

Federico Charosky, founder of Edinburgh, Scotland-based security firm Quorum Cyber, said a common technique among suspected North Korean crypto hackers is to lure engineers working for exchanges to participate in fraudulent job interviews in which they’re tricked into installing malicious code on their computers. The concentration of resources in the crypto industry makes it an especially vulnerable target for these kinds of attacks, he said.

“For years the crypto community tried to sell everyone on the benefits of a supposedly decentralized currency, yet we keep seeing how this asset is nothing but centralized,” he said. “Small players can massively move the market by making buy/sell decisions, and threat actors can steal $6 billion in one hit. How is this decentralized? It also shows why the traditional financial system has built intentional friction – to prevent situations like this from taking place.”

“So maybe old-school banks, with all their processes, regulations, audits, oversight, and years of experience were not that bad, right?” he said.

Western governments have accused the North Korean state of fostering a number of hacking groups and using them to bring in money to fund weapons programs. The hackers known as Lazarus Group, one of the most formidable groups, dates back as far as 2007 and is controlled by the cyber operations arm of one of the country’s primary intelligence agencies, the Reconnaissance General Bureau, according to U.S. officials.

Top photo: The Binance logo on a smartphone arranged in Gyeongsan, South Korea, on Friday, Oct. 30, 2026. Digital tokens fell. Bloomberg.