How North Korea’s ruthless state sponsored hackers, main suspects in the $6.3B Binance heist, operate

Cybersecurity experts are pointing the finger at North Korea being behind the $6.3 billion Binance hack.

The Hermit Kingdom’s hackers have a distinctive way of operating, and their fingerprints are all over the Binance heist — already hailed as the largest cryptocurrency theft in history.

Unlike the majority of hacking groups, North Koreans opening move is often a confidence trick aimed at an employee.

“They attack people, not code,” Lisa Zhao, security operation lead at cybersecurity firm SlowMist told The Post.

In investigations SlowMist conducted in 2025, attackers posed as project teams and offered developers paid work fixing software. Some offered money upfront to establish trust, others presented themselves as investors with trading software to test.

Their trap was hidden in the work itself. Attackers modified a real, publicly available software project and added malicious code.

“In many of the cases we encountered, no individual step looked like an attack — just helping with debugging, testing some code or changing a setting.”

Even employees who took precautions could be manipulated. Some ran the software in an isolated environment to protect the rest of their computer.

But then attackers asked for a seemingly reasonable adjustment to get their project working, which weakened that protection and gave them greater control, Zhao said.

From there, the hackers can make their way into their intended company’s network, steal credentials and get closer to the systems controlling its money, at this point using the company’s own tools to help disguise their activity.

Zhao said her team observed links between the stolen Binance funds and IP addresses associated with earlier North Korea thefts.

“We detected links between the Binance hackers’ funds and addresses involved in the Phemex theft in early 2025, which we already linked to North Korean hackers,” Zhao told The Post.

Blockchain intelligence firm TRM Labs separately attributed the attack to North Korea’s state-backed TraderTraitor operation, with high confidence, also citing similarities to earlier heists.

What sets North Korea’s state-backed hackers apart from ordinary cybercriminals is their mission. Other hackers steal for themselves, but the North Korea steals for the regime, headed by Supreme Leader Kim Jong Un.

US Treasury officials have linked North Korea’s cyber theft to funding its weapons programs.

Zhao says the attackers’ strengths combine patience, organization and an established ability to move and launder stolen cryptocurrency.

“Their money laundering infrastructure is well developed… They move the funds fast between digital wallets and swap it to other cryptocurrencies, making it very difficult to stop them,” she said. 

SlowMist founder Yu Xuan warned North Korean hack groups — such as Lazarus Group, Bluenoroff, and Andariel, according to feds — use other countries as gateways to their targets, for example hacking into a US system, then going from there to target Europe or Japan.

“The common perception of North Korea is that it is poor and cut off from the world, but these kinds of hacking groups can [get into] computers belonging to people already in the United States to carry out attacks,” he said.  

“The activity is supported by the state, and their network can still have many stepping stones that allow it to reach any corner of the world.”

To make things worse — AI can make the work behind those attacks faster and cheaper, from writing malicious code to preparing its delivery. 

“A hacking group that might previously have focused on roughly five to 10 targets over six months or a year might now be able to focus on 50 to 100,” Xuan said. “Many things that previously required manually writing code or people carrying out repetitive tasks can now be done much more efficiently with AI.”

Microsoft reported this week that several North Korean threat groups had incorporated AI into operations, including deceptive recruiting material, fabricated identities and malicious-code development.

Attackers can also exploit employees’ fear of admitting a mistake.

“Some employees who had been deceived would actively delete relevant records because they were afraid of being held responsible. They would also fail to report the incident promptly, making investigation and evidence collection very difficult,” Zhao said.

“That exploitation of human nature surprised me more than their technical methods.”

Binance did not confirm North Korean involvement in its response to The Post. The company has said it is working with law enforcement to identify the criminals and will cover all hacked losses with company funds.

“Your assets are safe,” co-CEO Richard Teng said in a statement supplied by the company.