Cybersecurity consultants are pointing the finger at North Korea being behind the $6.3 billion Binance hack.

The Hermit Kingdom’s hackers have a distinctive approach of working, and their fingerprints are all over the Binance heist — already hailed as the largest cryptocurrency theft in historical past.

Unlike the majority of hacking teams, North Koreans opening transfer is usually a confidence trick aimed at an worker.

North Korean chief Kim Jong Un attends a drone exhibition in Kangwon Province on Oct. 29, 2026. State-backed North Korean hackers are suspected in the $6.3 billion Binance heist. KCNA VIA KNS/AFP via Getty Images

North Korean chief Kim Jong Un, proper, and his daughter stand with troopers in a picture launched by KCNA on Nov. 27, 2022. Hackers working for his regime are suspected in the $6.3 billion Binance heist. KCNA VIA KNS/AFP via Getty Images

“They attack people, not code,” Lisa Zhao, safety operation lead at cybersecurity agency SlowMist advised The Post.

In investigations SlowMist performed in 2025, attackers posed as venture groups and supplied builders paid work fixing software program. Some supplied cash upfront to set up belief, others introduced themselves as buyers with buying and selling software program to check.

Their lure was hidden in the work itself. Attackers modified a actual, publicly accessible software program venture and added malicious code.

“In many of the cases we encountered, no individual step looked like an attack — just helping with debugging, testing some code or changing a setting.”

Even workers who took precautions could be manipulated. Some ran the software program in an remoted surroundings to defend the relaxation of their pc.

Lisa Zhao, safety operation lead at SlowMist, says North Korean hackers “attack people, not code,” utilizing paid work and seemingly innocent requests to win workers’ belief. Courtesy of Lisa Zhao

But then attackers requested for a seemingly affordable adjustment to get their venture working, which weakened that safety and gave them higher management, Zhao said.

From there, the hackers can make their approach into their meant firm’s community, steal credentials and get nearer to the techniques controlling its cash, at this level utilizing the firm’s own instruments to assist disguise their exercise.

Zhao said her workforce noticed hyperlinks between the stolen Binance funds and IP addresses related with earlier North Korea thefts.

An FBI wished discover for alleged Lazarus hacker Park Jin Hyok in 2018. The North Korean community has been linked to main cryptocurrency thefts. Federal Bureau of Investigation

A person makes use of a laptop computer in a 2020 file picture. North Korean hackers use paid work provides to trick builders into working malicious software program, investigators say. ryanking999 – inventory.adobe.com

“We detected links between the Binance hackers’ funds and addresses involved in the Phemex theft in early 2025, which we already linked to North Korean hackers,” Zhao advised The Post.

Blockchain intelligence agency TRM Labs individually attributed the attack to North Korea’s state-backed TraderTraitor operation, with excessive confidence, also citing similarities to earlier heists.

What units North Korea’s state-backed hackers aside from strange cybercriminals is their mission. Other hackers steal for themselves, but the North Korea steals for the regime, headed by Supreme Leader Kim Jong Un.

A hacker in a 2016 file picture. AI can assist North Korean hacking teams write malicious code and goal more firms, cybersecurity consultants say. TaylerDerden – inventory.adobe.com

US Treasury officers have linked North Korea’s cyber theft to funding its weapons packages.

Zhao says the attackers’ strengths mix endurance, group and an established capability to transfer and launder stolen cryptocurrency.

“Their money laundering infrastructure is well developed… They move the funds fast between digital wallets and swap it to other cryptocurrencies, making it very difficult to stop them,” she said. 

SlowMist founder Yu Xuan warned North Korean hack teams — such as Lazarus Group, Bluenoroff, and Andariel, according to feds — use other international locations as gateways to their targets, for instance hacking into a US system, then going from there to goal Europe or Japan.

North Korean chief Kim Jong Un attends a drone exhibition and weapons demonstration in North Korea on Oct. 29, 2026. Hackers working for his regime are suspected in the $6.3 billion Binance heist. via REUTERS

“The common perception of North Korea is that it is poor and cut off from the world, but these kinds of hacking groups can [get into] computers belonging to people already in the United States to carry out attacks,” he said.  

“The activity is supported by the state, and their network can still have many stepping stones that allow it to reach any corner of the world.”

To make issues worse — AI can make the work behind these attacks quicker and cheaper, from writing malicious code to making ready its supply. 

Microsoft’s New York workplace in May 2025. The firm warns North Korean hackers are utilizing AI to pretend identities and develop malicious code. Getty Images

Binance founder Changpeng Zhao at Viva Technology in Paris in June 2022. The alternate has pledged to cowl all losses from the $6.3 billion heist. REUTERS

“A hacking group that might previously have focused on roughly five to 10 targets over six months or a year might now be able to focus on 50 to 100,” Xuan said. “Many things that previously required manually writing code or people carrying out repetitive tasks can now be done much more efficiently with AI.”

Microsoft reported this week that several North Korean menace teams had integrated AI into operations, including misleading recruiting materials, fabricated identities and malicious-code growth.

Attackers can also exploit workers’ worry of admitting a mistake.

“Some employees who had been deceived would actively delete relevant records because they were afraid of being held responsible. They would also fail to report the incident promptly, making investigation and evidence collection very difficult,” Zhao said.

“That exploitation of human nature surprised me more than their technical methods.”

Binance did not confirm North Korean involvement in its response to The Post. The firm has said it is working with legislation enforcement to determine the criminals and will cowl all hacked losses with firm funds.

“Your assets are safe,” co-CEO Richard Teng said in a assertion provided by the firm.