An industry-shaking event
In the early hours of October 30, 2026, Binance’s hot wallets across nine blockchains were attacked simultaneously, and assets worth more than $6.26 billion were transferred out.
The following day, the U.S. Federal Bureau of Investigation (FBI) formally accused a North Korean hacker group of involvement in the theft. U.S. officials said that if North Korea is confirmed to be responsible, the United States will pursue further discussions.
From stealing $7 million in a 2017 attack on South Korean exchange Bithumb to Binance losing billions overnight today, the highly isolated North Korea has evolved into crypto’s top predator in less than a decade.
I. A PDF, a $600 Million Vulnerability
The North Korean hackers’ preferred attack strategy is: find a person $\rightarrow$ fool that person $\rightarrow$ use that person to open a door.
•
Ronin Bridge case (March 2022, $620 million):
The attackers sent a fake job offer (PDF) via LinkedIn to a senior engineer at Sky Mavis. The moment the engineer opened the file, spyware infiltrated the system, helping the hackers steal four validator keys. Combined with an old temporary authorization that had never been revoked, this ultimately led to the theft of $620 million.
•
Bybit case (February 2025, $1.5 billion):
The attackers did not target Bybit directly. Instead, they infiltrated the infrastructure of Safe{Wallet}, its multisig wallet service provider, and inserted malicious code into the signing process, compromising the upstream supply chain entirely.
•
Binance case (October 2026, $6.26 billion):
The hackers breached a laptop belonging to an operations engineer and exploited the internal system and the EIP-7702 protocol to get a hot wallet to sign a malicious delegation authorization, ultimately making off with the entire haul.
II. “Inside the Door”: Your Colleague Could Be a North Korean Spy
In addition to external attacks, North Korea also covertly infiltrates major crypto companies by sending large numbers of IT workers.
•
Scale of infiltration: The United Nations estimates that North Korean IT workers generate up to $600 million in revenue for the regime each year. According to CrowdStrike, they infiltrated more than 320 companies in just 12 months.
•
Methods of infiltration: They use forged passports and visas, and generative AI to get through video interviews. They specifically target startups with remote workforces that pay in cryptocurrency.
•
Notable cases:
•
In March 2024, an insider developer—who was actually a North Korean spy—drained $62 million from Munchables, an NFT game on the Blast blockchain, but unexpectedly returned the full amount after pressure from the community.
•
The founder of Truflation discovered that five members of the team were North Korean workers—one-third of the total workforce. The company subsequently suffered a private-key leak and a $5 million loss.
III. The Interview Defense: The “Kim Jong Un” They Couldn’t Speak About
The security community has found an interesting, low-tech way to identify North Korean applicants: ask candidates to make a brief negative comment about North Korea’s supreme leader, Kim Jong Un.
During one real undercover investigation, a North Korean hacker posing as a job applicant demonstrated impressive technical skills. But when the interviewer asked him to comment on Kim Jong Un, he fell silent and immediately left the video call. In North Korea, publicly criticizing the supreme leader can result in three generations of one’s family being imprisoned, making this an insurmountable “lie detector.”
IV. The Secret War: Forging State-Sponsored Hackers Over Nine Years
North Korea’s cyberwarfare program can be traced back to the “Secret War” of the 1980s.
1.
Brutal selection: Each year, only 100 of the 5,000 applicants to Kim Chaek University of Technology are admitted. The foremost criterion is an exceptionally strict political background (class status).
2.
Devilish training: Trainees undergo intensive programming and operating-system reverse-engineering training every day. They are strictly forbidden from relying on off-the-shelf tools and must write malware independently.
3.
High rewards: After graduation, they are sent overseas to operate undercover, earning up to $2,000 a month (twice the salary of a regular overseas ambassador). They are also allocated spacious apartments in Pyongyang and given residency status.
V. The Five Branches of the Phantom Empire
The Lazarus Group, identified by the U.S. Treasury Department, is in fact a vast network made up of multiple state-level operational units:
•
TraderTraitor (Big-Game Hunters): Specializes in targeting exchanges, custodians, and wallet systems (such as Ronin, WazirX, and Bybit).
•
AppleJeus (Supply-Chain Assassins): Develops trojanized software and exploits browser zero-day vulnerabilities (as in the Radiant Capital case).
•
BlueNoroff (Financial Hunters): Initially targeted traditional banks and the SWIFT system; has now shifted its focus entirely to cryptocurrency and the VC sector.
•
Famous Chollima (Infiltrators): Uses fake identities to get hired by major tech and crypto companies.
•
DangerousPassword (Casting a Wide Net): Sends phishing emails and fake communications software in bulk.
Conclusion
After the Binance incident, Elon Musk remarked on X: “Everyday is Zeroday.”
With the deep integration of artificial intelligence, hackers can produce phishing emails, fake résumés, and malicious code at vastly greater speed and scale. Attackers need to succeed just once, while defenders have to get everything right.
Behind a country with a per capita GDP of less than $2,000 lies a state war machine that has been operating for four decades. The entire crypto industry has to face this harsh reality: your adversary is a nuclear-armed state with the full force of cyberwarfare at its disposal.