North Korea's Hackers Employ Social Engineering in Massive Crypto Heists, Experts Say

Cybersecurity experts are pointing to North Korea as the perpetrator of the $6.3 billion Binance hack, the largest cryptocurrency theft in history. The nation's hackers employ a distinctive operational method, often initiating attacks by targeting individuals rather than directly exploiting code.

According to Lisa Zhao, security operation lead at cybersecurity firm SlowMist, North Korean hackers prioritize social engineering. "They attack people, not code," Zhao stated. In investigations conducted in 2025, attackers posed as project teams and offered developers paid work on software fixes. Some of these offers included upfront payments to build trust, while others presented hackers as investors seeking to test trading software.

The malicious code was often embedded within the work itself. Attackers would modify legitimate, publicly available software projects and insert harmful code. Zhao explained that individual steps in the process did not appear to be overtly malicious, often masquerading as routine tasks like debugging, code testing, or setting adjustments. Even employees who implemented security precautions, such as running software in isolated environments, could be compromised. Attackers would then request seemingly minor adjustments to their projects, which would weaken security protocols and grant them greater access.

Once inside a company's network, the hackers could steal credentials and move toward financial systems, using the company's own tools to obscure their activities. Zhao noted that her team detected links between the stolen Binance funds and IP addresses associated with earlier North Korean thefts, including a Phemex theft in early 2025.

Blockchain intelligence firm TRM Labs independently attributed the attack to North Korea's state-backed TraderTraitor operation with high confidence, also citing similarities to previous heists. Unlike typical cybercriminals who steal for personal gain, North Korea's state-sponsored hackers aim to fund the regime led by Supreme Leader Kim Jong Un. U.S. Treasury officials have linked North Korea's cyber theft activities to the financing of its weapons programs.

Zhao highlighted the hackers' strengths: patience, organization, and a well-established infrastructure for moving and laundering stolen cryptocurrency. "Their money laundering infrastructure is well developed... They move the funds fast between digital wallets and swap it to other cryptocurrencies, making it very difficult to stop them," she said.

Yu Xuan, founder of SlowMist, warned that North Korean hacking groups, including the Lazarus Group, Bluenoroff, and Andariel—identified by federal authorities—use other countries as intermediaries to reach their targets. This allows them to attack systems in one nation and then pivot to targets in other regions.

"The common perception of North Korea is that it is poor and cut off from the world, but these kinds of hacking groups can [get into] computers belonging to people already in the United States to carry out attacks," Xuan said. He added that the state's support enables their network to establish numerous stepping stones for global attacks.

Artificial intelligence is further amplifying their capabilities. Microsoft reported that several North Korean threat groups have integrated AI into their operations, using it for deceptive recruiting materials, fabricated identities, and the development of malicious code. AI can accelerate and reduce the cost of these attacks, allowing groups to target significantly more entities than before. "Many things that previously required manually writing code or people carrying out repetitive tasks can now be done much more efficiently with AI," Xuan observed.

Attackers also exploit employees' fear of admitting mistakes. Zhao noted that some deceived employees proactively delete records to avoid responsibility, delaying incident reporting and complicating investigations. "That exploitation of human nature surprised me more than their technical methods."

Binance has not confirmed North Korean involvement but stated it is cooperating with law enforcement to identify the perpetrators and will cover all losses incurred by the hack using company funds. Co-CEO Richard Teng assured customers, "Your assets are safe."