Alleged North Korean hackers drained $6.3 billion from Binance last week in the largest cryptocurrency theft on record, and the techniques behind it reflect a broad, evolving playbook: infiltrating companies through fake identities, poisoning widely used code libraries, compromising wallet infrastructure, and increasingly deploying artificial intelligence to make each step more convincing.

The scale of the threat is considerable. One estimate attributes 60% of all crypto losses last year to groups linked to the Democratic People's Republic of Korea (DPRK). These actors use several different vectors of attack at once, making them harder to catch in the act.

Last week, it took just 20 minutes for the alleged North Korean attackers to drain $6.3 billion from Binance, the biggest crypto hack on record. According to the exchange, they compromised a Binance engineer's work computer through a fake job interview, used an internal AI tool to gain control of other engineers' computers, and then used stolen credentials to hijack an internal wallet signing service.

— Binance (@binance) November 3, 2026

Historically, North Korean hackers have been known to get hired at crypto companies under fake identities, attack through third-party infrastructure, and poison widely used code libraries. More recently, they have started using AI to make all of it more convincing. Here are the methods they are known to use in crypto attacks.

Fake employees

Binance chief security officer Jimmy Su told Decrypt in August 2025 that the exchange throws out suspected North Korean resumes every day, and that "almost all the large DPRK hacks" at the time had involved a fake employee helping facilitate the attack.

Su said there were tell-tale signs in resumes indicating an applicant was from North Korea, but the exchange was not willing to reveal the specifics of those red flags. Sometimes malicious actors make it through to the interview stage, where they use deepfakes to change their face and voice.

"The only real good detection is that they almost always have a slow internet connection," he told Decrypt. "What's happening is that the translation and the voice changer are working during the call … that's why they are always delayed."

Those who do get hired tend to be suspiciously good at the job. Su said North Korean workers are often among a company's top performers, likely because several people may be sharing one role across time zones.

The threat has not let up. Binance said its security team detected and prevented 57 suspected North Korea-linked cyber threat cases in 2026, using techniques ranging from fraudulent job interviews to fake video conferencing apps.

Fake job interviews

Attackers also flip the scam around, posing as recruiters to target people who already work at high-profile crypto companies. Often, the attacker claims there is a video or audio issue during the interview and sends the victim a link to update Zoom, which infects their device with malware.

"The DPRK group will [also] try to schedule calls with the external-facing employees," Su told Decrypt. "Either as a DeFi project or investment firm. Worst yet, they'll be recruiting them for a high-level job, paying twice, three times as much, just to get them onto an interview."

This is how the Binance attack began, according to the exchange. In September, a Binance software engineer was approached through a legitimate job-hunting platform by someone posing as a project director, who set up two interviews. In the first, a purported HR representative built trust over a live video call by sharing a social media account full of personal photos and videos—an approach Binance called "more advanced and deceptive than previously seen."

In the second interview, held on a chat app, the engineer was told to download an "assignment" onto his work computer. The code repository contained previously unknown malware that ran during setup, swapped a legitimate developer tool for a malicious version, and connected to an attacker-controlled server, evading Binance's security tools.

Similar methods have been used at scale elsewhere. One North Korea-linked group infected at least 30,000 devices in more than 100 countries between roughly December 2025 and July 2026, taking funds or credentials from more than 7,000 crypto wallets and moving around $10.71 million to North Korea.

That group, known as WaterPlum or Contagious Interview, posed as AI, crypto, or NFT companies and set candidates a technical interview or coding task that required downloading malware-filled files. Some used AI face-swapping software during interviews before cutting their own video and asking the candidate to do the same, blaming a bad connection.

Library poisoning

Su also told Decrypt that North Korean hackers poison public code libraries, ranking it as the second most common method of attack—behind fake employees.

Node Package Manager (NPM) packages are collections of reusable, open-source code that developers frequently rely on. Attackers can clone these packages and slip in a small line of malicious code while keeping the original function intact. That means a victim could use a poisoned code library without noticing, with the malicious code embedding itself deeper over time as more software is built on top of it.

In September 2025, software security firm ReversingLabs found two NPM packages that used Ethereum smart contracts to download malware, which the firm said it had not seen before. The packages were tied to a wider network of GitHub repositories, mostly branded as crypto trading bots, with thousands of commits and stars that ReversingLabs believes were mostly faked.

The tactic formed part of a "sophisticated campaign" of malicious actors attempting to hack users via poisoned blockchain-related public code libraries—a vector of attack that Binance has previously attributed to North Korean hackers. To counter the threat, Su said, Binance makes employees go through NPM libraries with a fine-tooth comb.

Tampered developer tools also played a part in the Binance hack. In June, a member of Binance's wallet DevOps team downloaded a tampered installation of Homebrew, a popular software installer, while trying to install an AI coding tool he had found through a search engine, the exchange said. Its security team caught the problem, replaced the device, and rotated his credentials, but the incident exposed the engineer and his colleagues on the wallet infrastructure team to the attackers.

Infrastructure attacks

Before Binance, the unwanted record for the largest crypto hack belonged to Bybit, which lost $1.4 billion in February 2025—less than a quarter of the amount taken from Binance. Cybersecurity firms revealed that North Korean hackers pulled off the attack by planting malicious code into the infrastructure of Safe, a crypto wallet provider used by the exchange.

The security firms said malicious JavaScript code was directly injected into Safe's online infrastructure, though it remained unclear how the attackers managed to do this. Bybit's infrastructure "was not compromised," the exchange told Decrypt—the hack came purely because a third party was exploited.

The Binance attack, by contrast, targeted the exchange's own systems. On October 29, the attacker used stolen credentials to deploy a container—an isolated software environment used to run services within a company's own infrastructure—and gain unauthorized access to an internal wallet signing service, which let it initiate transactions outside Binance's normal withdrawal process. On Ethereum, it used the signing service to exploit EIP-7702, a mechanism that lets an account delegate execution rights to a smart contract, giving an attacker-controlled contract partial control over a Binance hot wallet, the internet-connected wallet that exchanges rely on to handle customer withdrawals.

Those on-chain authorizations kept working even after Binance suspended withdrawals. Because the hot wallet used multi-party computation, an approach that splits key control across multiple parties so no single participant holds the complete key, there was no single private key Binance could use to revoke them quickly, the exchange said.

AI-powered scams

Every one of the above attack vectors can be turbo-charged with artificial intelligence tools.

Early this year, Google warned of an AI-powered malware campaign targeting crypto companies coming from North Korea. Binance's Su has likewise noted that AI tools can be used to increase the effectiveness of attacks.

Concerns around AI-powered hacks have risen in recent months, with Ethereum co-founder Vitalik Buterin saying in October that it is "plausible" AI could break encryption within the next two years. It came amid an explosion in AI-driven mathematics, with OpenAI claiming to have cracked a 90-year-old math problem in a matter of days, and experts urged the industry to prepare for AI-powered attacks on encryption.

There are no confirmed reports of North Korean hackers using AI to break encryption. But given how quickly they have adopted AI elsewhere, the industry may have to prepare for that next.