OMM Newsroom
The $6.3 billion theft from cryptocurrency exchange “Binance” followed months of intelligence gathering, fake job interviews and the exploitation of internal artificial intelligence tools, experts told Anadolu Agency, pointing to suspected North Korean involvement.
Described as the largest cryptocurrency theft on record, the operation showed how attackers can use employee manipulation alongside technical intrusions to compromise systems that authorise digital asset transfers.
Ari Redbord, global head of policy and government affairs at US blockchain analytics firm “TRM Labs”, attributed the attack to North Korea, saying cybertheft helps finance the sanctioned government and its weapons programmes.
Ersin Dincelli, an associate professor of information systems at the University of Colorado Denver, said the case demonstrated the extensive reconnaissance and planning behind modern cyberattacks.
Fake recruitment provided access to company systems
According to a “Binance” report published on Nov. 3, the attackers first targeted an engineer in June as the employee attempted to install an AI-powered coding tool.
The company’s security team detected suspicious activity and replaced the engineer’s device and credentials. By then, however, the attackers had gathered information about the employee’s responsibilities and colleagues.
In September, people posing as recruiters for a nonexistent company invited another “Binance” engineer to a fake job interview. A coding assignment that followed led the employee to download files containing malicious code onto a work computer, giving the attackers access to company systems.
On Oct. 20, the attackers used an internal AI tool to help access the computers of two more engineers.
They deployed malware on Oct. 29 using credentials stolen from another engineer, then gained unauthorised access to an internal wallet-signing service used to approve transactions.
Within four minutes, they transferred 233.46 million XRP from five “Binance” wallets to an address they controlled. Later transfers included around 970,500 SOL, 44.2 million OP and 18,270 bitcoin.
“Binance” suspended withdrawals after detecting unusual transfers, but the attackers’ existing permissions meant the company could not immediately stop all unauthorised transactions.
The exchange said on Oct. 30 that the incident had an approximate total impact of $6.3 billion. It said cooperation with industry partners had helped freeze around $3 billion in assets on the blockchain.
The amount stolen was about 4.2 times the approximately $1.5 billion taken from “Bybit” in February 2025, which had previously been the largest cryptocurrency theft on record.
Experts point to months of reconnaissance
Redbord said it would have taken months of research to identify wallet engineers by name, determine who had signing authority and understand how teams worked together.
Job titles, professional profiles and conference participation can help attackers identify targets and map their responsibilities, he said.
He described fake recruiters, fraudulent interviews and malicious coding assignments as recurring methods linked to North Korean operations. Engineers may take such approaches seriously because recruitment messages and coding tests are routine parts of hiring.
Redbord said the progression from an initial intrusion in June to the eventual theft reflected a patient intelligence operation, with each stage building on access gained earlier.
He recommended running code received from outside the organisation in disposable virtual environments on separate hardware. Exchanges should also set hot-wallet limits, withdrawal caps and delays for large transfers, he added.
Dincelli said even sophisticated technical safeguards could be undermined when employees were unaware of social engineering tactics that exploit curiosity, fear, urgency or other human motivations.
Experienced engineers could also fall for such schemes, he said, describing the “Binance” attack as a carefully coordinated operation carried out over several months.
Open-source intelligence tools and AI-powered automation have made it possible to gather information and build detailed profiles of potential targets at little or no cost, Dincelli added.
The FBI accused North Korea on Oct. 31 of stealing $6.3 billion in digital assets from “Binance”, linking the operation to activity known as TraderTraitor. It urged cryptocurrency companies to block transactions involving associated addresses.
North Korea rejected the accusation. Kim Yo-jong, the sister of leader Kim Jong-un, accused Washington of trying to portray Pyongyang as a cybercriminal state and suggested the US could benefit from recovering stolen cryptocurrency for its strategic reserves.
Dincelli said the distinction between state-backed cyberoperations and financially motivated crime was becoming increasingly blurred.
While state-sponsored attacks have traditionally focused on espionage and geopolitical objectives, North Korea illustrates how such operations can also be used to steal cryptocurrency and generate government revenue, he said.
