Five Ways North Korea Breaks Into Crypto Firms—and How Binance Was Hacked
North Korean-linked hackers use fake job interviews, deepfakes, malware, poisoned software packages and compromised developer tools to target crypto companies. Binance says a September 2026 attack began when an engineer downloaded malware disguised as a coding assignment; stolen credentials later let attackers access an internal wallet-signing service. Binance reported blocking 57 suspected DPRK-linked cases in 2026. The piece also describes a campaign that infected 30,000 devices and accessed over 7,000 crypto wallets, plus the 2025 Bybit hack traced to compromised third-party infrastructure. AI is making social engineering and malware more convincing, though there is no confirmed evidence of North Korean groups using AI to break encryption.
