Chainalysis has attributed more than $14.3 million in cryptocurrency losses over the past 18 months to the North Korean fake job interview playbook that was later used against Binance. According to the blockchain analytics firm's findings, those smaller heists served as practice for the $6.3 billion theft from the exchange.

The losses stem from DPRK-linked fake interviews and malware schemes, with targets ranging from individual crypto holders and private wallets to protocols and decentralized autonomous organizations (DAOs).

Dozens of fake job interviews led to wallet compromises

“We've identified dozens of other job interview compromises that have led to wallet compromises” at the individual level, said Tom McLouth, a senior intelligence analyst at Chainalysis. Individual losses ranged from tens of thousands of dollars to millions.

North Korean crews were “perfecting and evolving their methodology” in those attacks, he added. “That's how you end up with the biggest heist in history,” McLouth said.

In Chainalysis's assessment, the Binance attack could be the culmination of months or even years of rehearsal. Cryptopolitan previously reported that Binance traced its breach to a job interview invitation sent to an engineer in September. After two rounds with a fake company, the engineer downloaded an interview assignment that had been seeded with malicious code.

Alec Zebrick, Chainalysis's Senior Manager of Global Services, refers to this tactic as “contagious interviews,” which target staff with privileged access so that their credentials can be turned against their employer.

Chainalysis also highlighted instances of private keys being stolen from cloud storage following a malicious interview. Some victims said their seed phrases had never been stored on the infected device, which the firm says may indicate stolen cloud logins or hijacked browser sessions. That detail illustrates why wallet security now reaches beyond a single device: the cloud accounts and browser sessions used to store or sync credentials can become the breach point themselves.

In March, Microsoft documented that its Defender Experts team has tracked a Contagious Interview campaign active since at least December 2022. In that operation, fake recruiters posing as staff at crypto trading firms or AI companies persuade applicants to run malicious code packages. Microsoft said the malware inside searches for wallet mnemonic phrases, KeePass and 1Password stores, and cryptographic keys. With fake recruiters impersonating employers in both crypto and AI, the hiring process itself has effectively become an attack surface.

Blockchain Dead Drops surged fivefold in a year

Chainalysis also reports that blockchain-enabled cyberattacks have increased fivefold over the past 12 months. The firm calls the technique Blockchain Dead Drops and attributes the uptick to nation-state actors and the potential use of open-weight AI models.

North Korean actors began using the approach, known as “Etherhiding,” in early 2025. It links machines infected through fake job interviews to the attackers' command-and-control servers, since a blockchain record is harder for law enforcement to seize than centrally hosted infrastructure.

One DPRK setup divided instructions between TRON and Aptos. Both chains hold pointers to a payload hosted on BSC, and infected devices are redirected to it, with Aptos serving as the fallback if TRON fails. A newer “null receiver” variant embeds the instruction inside a specially crafted address that is uncontrolled and not designed to hold crypto; infected machines interpret the address as a command. The arrival of a newer variant this soon after Etherhiding's early-2025 debut points to a playbook that is still being actively refined.

In September, the FBI, Japan's National Police Agency, and agencies in Australia and Germany publicly blamed a North Korean crew known as WaterPlum for a roughly $10.71 million crypto heist. WaterPlum is also referred to as the “Contagious Interview” group, and its operations affected sensitive data on about 7,000 crypto accounts. The joint attribution by authorities across four countries shows the scale of the enforcement response the tactic has drawn internationally.

The FBI attributed the Binance heist to the North Korean group TraderTraitor, though Pyongyang denied any involvement. Chainalysis expects the stolen funds to remain on the move over the coming days.