nullstate

How North Korea hit Binance, and why the next one could be harder to stop
It may have started with a test.
According to early reports, a Binance engineer was talked into taking one. Malware landed on their laptop while they did it. That laptop was already logged in and already trusted, so it became the attacker’s way straight into production, and from there to the wallets. Binance hasn’t confirmed the test part. What it has said is that the incident may have started with a compromised DevOps engineer’s laptop, which gave the attacker access to a service container where unauthorized withdrawals were submitted.
By the time the outflows stopped, about $6.3 billion in assets was gone. That is the largest crypto theft on record. The old record was the $1.5 billion Bybit hack in February 2025, so Binance lost more than four times as much. Binance said about $3 billion of it was frozen on-chain early on, with help from its blockchain partners.
On Saturday, the FBI said who did it. The bureau blamed TraderTraitor, a North Korean state-sponsored unit and the same one it blamed for Bybit. It says the group was seen converting the stolen assets mainly into Ethereum, and it expects the money to be laundered further in stages. It also asked exchanges and other crypto service providers to block the addresses it listed.
Binance’s own account is that this was not a one-click job. Co-CEO Richard Teng called it a “complex attack,” said more than one person was involved, and said the malware was built to delete evidence of its own activity. Withdrawals have been suspended while Binance rebuilds that part of its system.
Binance says users will not pay for any of this. It has bought back about 90 percent of the stolen tokens with its own money, pulling from its SAFU reserve (a roughly $1 billion fund held for exactly this kind of emergency), part of its Futures Insurance Fund and its corporate treasury. The rest are less liquid tokens that take longer to buy. Binance says withdrawals reopen Sunday, and it has published a new proof-of-reserves snapshot so users can check that assets are backed at least 1:1.
A very old business
North Korea has been doing this for more than a decade, and the targets keep getting bigger.
In 2014 it was Sony Pictures. In 2016 it was a central bank. Hackers took over systems at Bangladesh Bank and used the SWIFT network to send 35 fraudulent transfer requests to the Federal Reserve Bank of New York, for close to $1 billion. About $81 million went through. The New York Fed stopped the other 30 requests, worth roughly $850 million, after a misspelled instruction raised suspicion. A spelling mistake is a big part of why this wasn’t a billion-dollar heist.
Then came WannaCry in 2017, the ransomware that hit hundreds of thousands of computers across about 150 countries. Symantec said it was highly likely the Lazarus Group was behind it. The US later charged a North Korean national, Park Jin Hyok, over Sony, WannaCry and the Bangladesh job, and in 2019 the Treasury sanctioned Lazarus and its sub-units Bluenoroff and Andariel.
Bangladesh was the preview. MIT Technology Review described that heist as the one that foreshadowed the group’s turn to crypto exchanges, and it is easy to see why. Banks have compliance desks and a Federal Reserve that can be called. Once a crypto transfer lands in the right wallets, nobody picks up the phone.
The numbers show how well it worked. A UN panel looked at 58 suspected North Korean cyberattacks between 2017 and 2023 and put the haul at about $3 billion. Chainalysis counted $1.7 billion stolen in 2022, $660 million in 2023, and $1.34 billion in 2024 across 47 incidents. The FBI tied the same TraderTraitor unit to the $600 million Ronin bridge hack, the $100 million Harmony bridge hack, a $308 million theft from the Japanese exchange DMM in 2024, and then Bybit, a Dubai-based exchange, for $1.5 billion.
As of the Bybit hack, estimates put everything North Korea had stolen from crypto since 2017 at around $6 billion. Binance alone is now about the same.
The motive is not complicated. North Korea is cut off from the global financial system, and a senior US official has called crypto theft a major source of revenue for the regime’s missile program.
Now add AI
Go back to the test. If the early reports are right, the lure was something that looked like part of a hiring process, and fake recruiters are a known North Korean method. Chainalysis has said these groups use generative AI to build believable recruiter profiles on professional networking sites. For years, one way to spot these operations was the writing, because clumsy English or Korean gave them away. AI removes that problem.
To be clear, nobody has said AI was used against Binance. But the direction is plain. In August, the South Korean security firm Genians reported that Kimsuky, a different North Korean hacking unit that the US Treasury sanctioned in 2023, was running open AI models such as Ollama, GPT4All and Msty on its own machines. The reason is simple. Commercial chatbots log activity and screen for abuse. A model on your own hardware has none of that, so there is nobody to refuse the request and nobody to report it.
The toolkit goes well past a chatbot. Genians says the group uses retrieval tools to sift through stolen documents, agent frameworks to chain tasks together, speech-to-text software, and the AI coding tool Cursor to help write and refine malware. One result is finance and crypto-themed lure documents made to look like ordinary workplace reports.
Genians found no sign that the group trained a model of its own, and it didn’t need to. Open models running on private hardware sit outside any provider’s monitoring, and versions with the safety training removed exist. That finding rests on one firm’s research and hasn’t been independently verified. Kimsuky is also an espionage unit, not TraderTraitor, so I’m not saying the same people used the same tools on Binance.
What to watch
Binance says it will publish a detailed technical post-mortem once the investigation is complete. It has already said there were more points of breach than the laptop. That report will show how many layers failed between one engineer’s machine and billions of dollars in customer assets. If North Korea’s operators can write better lures, read stolen internal documents faster and automate more of the work, more layers have to hold.
Binance can absorb a $6.3 billion loss. The next exchange hit this way may not be able to.