Before breaching Binance's $6.3 billion, how did North Korean hackers refine their fake job-hunting scripts across dozens of attacks?

Author: Chainalysis

Compiled by: TechFlow

TechFlow: As the most devastating single security incident in cryptocurrency history, Binance's $6.4 billion theft was not caused by a single smart contract vulnerability or a high-severity zero-day system flaw. Instead, it was the culmination of years of meticulous refinement by a state-sponsored North Korean hacking group focused on "human-centric social engineering infiltration." From early days of cast-net phishing links on professional networking platforms to tailored "high-salary bait and sequential interview" campaigns aimed at core protocol developers, North Korean hackers have weaponized seemingly compliant recruitment processes into Trojan horses that strike directly at internal networks.

In the Binance case, attackers bypassed legitimate recruiter backgrounds, conducted multiple rounds of simulated technical screenings, and established an initial foothold on victim terminals using malicious code test assignments. They then leveraged locally active credentials and internal collaboration tools to execute fatal lateral movement toward core business clusters. This systemic compromise signals the failure of traditional static network perimeter defenses; crypto enterprises and security teams must prioritize endpoint behavior auditing, continuous red team simulation exercises, and real-time on-chain fund anomaly monitoring.

Executive Summary

Binance Reveals North Korean Fake Job Scam Behind Its $6 Billion Theft: Attackers targeted Binance employees using fabricated job opportunities and a series of fraudulent interviews, transforming what appeared to be a standard hiring process into the breach point for the largest theft in cryptocurrency history.

Minor Attacks Have Helped North Korean Hackers Continuously Refine Their Playbook: Over the past 18 months, Chainalysis has attributed over $14.3 million in losses to similar North Korean-linked fake interview scams. Analysis indicates these early incursions allowed North Korean actors to repeatedly hone their tactics against smaller targets before deploying them against higher-value objectives.

This Attack Is Only the Tip of the Iceberg for North Korea’s Vast Illicit Recruitment Ecosystem: The fake interview playbook is just one component of North Korea’s high-yield cybercrime ecosystem, which also encompasses identity-fraudulent IT outsourcing recruitment and on-chain money laundering networks. Chainalysis continues to track the evolution of these tactics and the underlying crypto infrastructure.

The incident of North Korean hackers stealing up to $6.4 billion from Binance began with a classic tactic its teams are already highly adept at: employment fraud.

Chainalysis investigators have closely tracked this strategy for years. The tactic takes many forms: in the Binance case, North Korean hackers lured a victim employee into applying for a fake position, leading to malware installation on their computer. In other cases, attackers directly impersonate applicants themselves, either using false identities to collect salaries that generate revenue for the regime, infiltrating corporate internal systems, or both.

Every security incident leaves clues on-chain. Over the past 18 months, Chainalysis has confirmed over $14.3 million in losses stemming from similar North Korean-linked fake interview and malware scams. These attacks target a broad spectrum of victims, ranging from individual crypto holders and standalone private wallets to institutional organizations, crypto protocols, and DAOs. Binance is merely the latest victim in this string of targeted campaigns.

“We have identified dozens of cases where wallet theft was triggered by job interviews,” noted Tom McLouth, Senior Intelligence Analyst at Chainalysis. While losses in early incidents ranged from tens of thousands to millions of dollars, their greater significance lies in providing attackers with hands-on operational experience.

McLouth further explained that across successive intrusions, the North Korean hacking group “is continuously refining and evolving its attack methodology,” persistently honing tactical paths and gradually building the operational capabilities required to hunt higher-value targets, “which is precisely how the largest heist in history ultimately took shape.”

In this industry context, the theft at Binance is far from an isolated incident; rather, it is the concentrated explosion of attackers who underwent meticulous preparation and field refinement over months or even years.

How Fake Interviews Opened the Doors to Binance

On Tuesday, Binance published preliminary investigation findings regarding the multi-stage attack carried out by North Korean hackers against its exchange.

The operation began in September when a Binance engineer received a job interview invitation. Binance detailed how the attackers spent weeks building trust with the employee: they first proactively contacted the engineer on mainstream recruiting platforms under the guise of a fabricated job opportunity.

After two rounds of interviews organized by a fictitious company, the Binance employee was asked to download a coding test containing malicious code, granting the attackers their initial foothold. Subsequently, the hackers deployed malware and leveraged the victim terminal’s access to internal AI tools to further penetrate deeply into Binance’s core internal network systems.

While the scale of this systemic compromise is unprecedented, the breakthrough methods employed by the hackers are hardly new. As Alec Zebrick, Senior Director of Global Services at Chainalysis, discussed in an interview this week,North Korean attackers have repeatedly employed a tactic dubbed "Contagious Interviews," specifically targeting employees with privileged access.

Hackers infiltrate corporate internal network environments by stealing target employees’ credentials and system permissions, making engineers and key personnel who have access to sensitive core infrastructure highly attractive, high-value targets for such operations.

The Binance theft clearly illustrates how fake interviews serve as the entry point to dismantle the security defenses of large institutions. Through collaborative attribution with industry partners, we have witnessed attackers steadily perfect this strategy step by step.

Following these malicious interviews, we observed multiple cases where victims' cryptocurrency wallet private keys were stolen directly from cloud storage. In some instances, victims explicitly stated that their seed phrases were never downloaded to their compromised local devices.

This phenomenon indicates that attacker control has long since extended beyond the local file system, likely achieving unauthorized access and privilege escalation through compromised cloud credentials or active browser sessions.

This forensic evidence aligns perfectly with Microsoft's security research report: North Korean malware systematically searches infected systems for cryptocurrency seed phrases and password manager residue data.

Credentials collected in the early stages of an operation can quickly become keys to unlock numerous linked accounts, with a blast radius far exceeding that of the initially compromised single device. In the Binance attack, it was this exact same foundational playbook—gaining an initial foothold via fake job interviews—that ultimately enabled hackers to surge straight into the exchange's core business architecture.

How North Korean Malware Lurks and Plants Itself in Target Systems

The Binance theft is merely a microcosm within North Korea's highly lucrative illicit recruitment ecosystem.

North Korean hackers extensively employ various social engineering tactics, including not only different variants of fraudulent recruitment scams, but also leveraging identity-fraudulent IT workers to infiltrate legitimate corporations from multiple angles.

Chainalysis has been tracking other emerging techniques developed and deployed by North Korean hackers to evolve and roll out such technology. One budding new threat involves attackers hiding malware commands within public blockchain space, a tactic we refer to as "Blockchain Dead Drops (BDD)."`

Our in-depth research report shows that over the past year, cyberattacks utilizing blockchains for covert communication have surged fivefold. This rapid growth is primarily driven by state-sponsored hacking groups, potentially catalyzed and supported by open-weight foundation AI models.`

Analysis reveals that North Korean hacking groups began employing a technique collectively known as "Etherhiding" as early as early 2025, aiming to establish a persistent link between victims' compromised computers from fake interview attacks and the malware's command-and-control (C2) infrastructure.`

Hackers opt for on-chain transactions because public ledger records are immutable and censorship-resistant. Compared to traditional centralized servers that are easily seized and shut down by law enforcement, blockchains offer a more resilient safe haven for deploying C2 relay networks.`

Chainalysis' on-chain analytics team uncovered a high-disaster-recovery technique used by North Korean hackers: dispersing C2 communication links across two distinct public blockchains, TRON and Aptos, to increase redundancy, thereby guiding infected terminals to ultimately redirect to a third chain, BSC.`

Attackers write specific pointers on TRON and Aptos, both of which target a specific transaction on BSC. Once a compromised machine encounters blocked queries to TRON nodes, it automatically switches seamlessly to Aptos as a fallback redundant channel. Regardless of the path taken, the victim terminal can accurately locate the target address on BSC storing the malicious payload.`

Recently, North Korean hackers have also evolved a new stealth tactic known as a "Null Receiver." Attackers directly encode and embed command data originally intended for C2 communications into a meticulously crafted on-chain burn address.`

This address is not actually controlled by any entity, nor is it used to store any crypto assets. However, once a malware-infected terminal captures this address string, it can directly reverse-engineer it into execution commands, thus completing command relay and control silently.`

Figure: On-chain C2 communication architecture where North Korean hackers utilize TRON and BSC burn addresses to store encoded commands and encrypted payloads

Unveiling North Korea's Highly Profitable Illicit Recruitment Ecosystem

On the other side of North Korea's employment fraud arsenal lies its broadly deployed large-scale IT worker program. In these schemes, North Korean technicians masquerade as legitimate candidates, applying and embedding themselves within major global corporations.

Through this, they earn high salaries, lie dormant seeking opportunities to infiltrate sensitive systems, and continuously funnel substantial foreign currency revenues to the national regime.

UN official estimates indicate that the North Korean IT labor ecosystem generates over $600 million annually for the regime. This massive underground shadow workforce intersects directly with the cryptocurrency ecosystem in countless ways.

In many cases, these IT employees deliberately embed themselves within Web3 and crypto organizations; simultaneously, they heavily utilize cryptocurrency money laundering to obscure illicit fund flows. Last month, we detailed a Russian and North Korean citizen money laundering network sanctioned by the U.S. Treasury, which provided funds transfer and whitewashing channels for North Korea's managed IT outsourcing framework.

Figure: Money laundering trail showing salary payments to North Korean IT employees from victim companies, aggregated through shell companies and cashed out by Russian intermediaries

Chainalysis closely monitors all crypto address entities on sanctions lists targeting North Korean IT worker fraud, deeply integrating open-source intelligence regarding this threat ecosystem.

North Korean IT technicians are typically stationed at overseas bases, where they use VPNs to obfuscate their network locations and leverage stolen false identities to apply for remote positions globally. Upon successful hiring, these employees often explicitly request that employers pay their salaries in stablecoins.

We have exposed such highly characteristic on-chain activities, including in specific cases where on-chain surveillance probes captured wallets regularly receiving fixed-amount salaries on a monthly basis.

Figure: On-chain transaction details recording North Korean IT employees' wallets receiving approximately $5,000 in regular monthly salary stipends

Once salaries are received, North Korean IT personnel quickly layer and transfer crypto assets through money laundering intermediaries, such as the aforementioned Russian and North Korean citizen money laundering network listed on sanctions.

How Chainalysis Tracks On-Chain Fund Flows

The major Binance security breach comprehensively demonstrates how North Korean hackers continuously evolve, test, and refine their multi-dimensional, collaborative cybercrime arsenal.

The same hacker syndicates capable of exploiting recruiting platforms for social engineering breaches to compromise corporate core infrastructure can also dispatch shadow employees to embed themselves in legitimate companies, skillfully utilizing cryptocurrency to covertly transfer stolen funds on-chain.

As attack methods continuously advance, enterprises and security agencies must never confine themselves to traditional cybersecurity perimeter defenses. Instead, they must bring underlying financial flows and on-chain infrastructure facilitating these transnational criminal operations under close monitoring.

Chainalysis maintains strict, round-the-clock surveillance on how North Korean hackers leverage the crypto ecosystem to generate revenue, aggregate and transfer illicit funds, and launder illegal proceeds.

Blockchain data intelligence plays a core role in this counter-defense combat. When on-chain analytics are deeply integrated with traditional cybersecurity defense measures and threat intelligence, security teams and judicial law enforcement agencies can precisely identify and urgently freeze stolen funds.

This comprehensive analytical capability not only aids in fully mapping North Korea's rapidly expanding on-chain financial network but also detects its procurement and payment funding chains, providing robust on-chain forensic evidence for international sanction investigations and joint judicial law enforcement.

The tracking investigation into the Binance theft is still proceeding at full force; we anticipate the stolen assets will continue undergoing on-chain splitting and transfers over the coming days. Chainalysis is fully cooperating with Binance and the broader crypto industry on joint attribution efforts to disrupt subsequent money laundering channels, striving to contain and mitigate potential secondary losses.

Frequently Asked Questions

How did North Korean hackers steal up to $6.4 billion from Binance?

The operation began with a fabricated job opportunity specifically targeting a Binance employee. Attackers gained the employee's trust through multiple rounds of interviews arranged by a fictitious company, subsequently sending them a programming assignment test containing malicious code.

Once the employee downloaded and ran the test code, their computer was infected, opening an initial foothold for hackers to enter the Binance system. Attackers subsequently deployed malware and leveraged the victim terminal’s access to internal AI tools to progressively infiltrate deeper into the exchange's core business infrastructure.

What is a North Korean fake interview attack scam?

A North Korean fake interview scam refers to a social engineering technique where hackers exploit fraudulent recruitment processes to compromise a job applicant's personal computer, thereby gaining access to sensitive corporate systems or stealing cryptocurrency wallets.

Attackers typically masquerade as industry recruiters or hiring managers, organizing seemingly formal and rigorous job interviews, and deliver trojan payloads via malicious coding tests or other downloadable attachments. Chainalysis categorizes these operations under the unified term "Contagious Interviews."

Have North Korean hackers previously used fake interview tactics in other crypto asset attacks?

Yes. Over the past 18 months, Chainalysis has confirmed that over $14.3 million in losses are directly attributable to similar North Korean fake interview and malware scams.

Victim targets encompass individual crypto holders, standalone private wallets, institutional entities, crypto protocols, and decentralized autonomous organizations (DAOs). These early attacks allowed North Korean hackers to thoroughly test and refine their social engineering playbooks before hunting higher-value targets.

How do fake job interviews help North Korean hackers infiltrate corporate organizations?

Fake interviews enable attackers to directly obtain target employees' personal endpoint devices, login credentials, and internal network access. Privileged employees with high-level permissions on critical infrastructure are highly valuable targets in hackers' eyes, because compromising their accounts and devices provides attackers with lateral jumpboards to strike directly at internal corporate systems.

What is the North Korean illicit IT worker scam?

This refers to North Korean technicians disguising themselves as legitimate applicants, typically leveraging stolen false identification and various network obfuscation techniques to secure remote work positions across global enterprises.

They use this to earn high salaries to replenish the national regime's treasury, while opportunistically seizing internal control over sensitive corporate systems. According to UN estimates, this gray ecosystem generates over $600 million annually for North Korea.

How does North Korea utilize cryptocurrency in its cybercrime activities?

Hacker syndicates associated with North Korea utilize cryptocurrency to both receive illicit freelance salaries and transfer and launder enormous theft proceeds from cyberattacks. Outsourced workers typically demand wage settlements in stablecoins, subsequently transferring them to money laundering intermediary accounts.

Additionally, hackers cleverly exploit public blockchain networks to conceal malware control commands, thereby constructing highly disaster-resilient, anti-blockade command-and-control (C2) relay infrastructure.

How does Chainalysis assist in tracking North Korea-related cybercrime?

Chainalysis assists by conducting round-the-clock deep analysis of on-chain fund trails, precisely identifying the operational pathways used by North Korean hackers and shadow entities to receive, transfer, aggregate, and launder illicit funds.

Such blockchain data intelligence enables security investigators and industry entities to trace the whereabouts of stolen assets, pin down money laundering intermediary networks, provide evidentiary support for sanction compliance investigations, and collaborate with ecosystem partners at critical junctures to exhaustively freeze stolen funds.