Ilya Lichtenstein says the tactics used in the Binance hot-wallet hack on October 29, 2026, resembled those associated with North Korean hackers. His assessment accompanies Binance's own account of an intrusion that combined fake recruitment schemes, malicious downloads and compromised internal AI tools, in an attack involving $6.34 billion in assets.

US President Donald Trump said investigators were examining a possible North Korean connection. Neither his statement nor Lichtenstein's assessment establishes North Korea's involvement. According to CNBC, Binance co-CEO Richard Teng stopped short of blaming North Korea directly, but confirmed that the FBI had tied the breach to North Korean hackers associated with the TraderTraitor group.

Lichtenstein suggested that employee phishing could serve as an entry point into cryptocurrency exchanges, rather than attacking their websites directly. The suggestion was not a confirmation of the route used in this incident. The observation points to where exchange security concentrates: staff devices, internal tools and the systems that move funds.

Months of infiltration preceded the hot-wallet breach

Binance's account describes a staged intrusion involving engineers and the systems that authorize wallet transactions. Teng said the attackers spent months gaining access, rejecting the notion that a single employee's laptop constituted a single point of failure.

A Binance security report traced the preparations to June, when an engineer downloaded a tampered Homebrew installation while searching for an AI coding tool. The exchange detected suspicious activity, replaced the device and rotated credentials, but said the engineer's role and colleagues had already been exposed. Homebrew is a widely used package manager, and the episode shows how a routine installation becomes an entry point once its source is tampered with.

In September, attackers posing as recruiters put another engineer through interviews and a coding exercise containing hidden malware, Teng said. They then moved through internal AI tools to reach the system authorizing wallet transactions. That sequence — staged hiring, hidden malware, lateral movement through internal tools toward the system that authorizes wallet transactions — matches the pattern Lichtenstein described.

Teng said Binance had replenished 98% of the affected assets and was purchasing the remaining, less-liquid holdings. Customers withdrew $3.6 billion when the exchange reopened on November 1. Binance pledged to cover customer losses and rebuilt the affected wallet system and internal AI tool. The figures convey the scale of the recovery: backfilling a multibillion-dollar shortfall, absorbing heavy withdrawals at reopening, and rebuilding compromised infrastructure.

Lichtenstein emphasized that the first 48 hours after an attack are critical for tracing stolen funds. Artificial intelligence can accelerate transfers after a theft, adding urgency to early tracking.

How investigators' examination of the possible North Korean connection develops, and when Binance completes its purchase of the remaining less-liquid holdings, are the next developments to watch.

This article was produced with the assistance of artificial intelligence and reviewed by the editorial team.