Cybersecurity experts are pointing the finger at North Korea being behind the $6.3 billion Binance hack.
asserted
Korea → point → hack
The Hermit Kingdom’s hackers have a distinctive way of operating, and their fingerprints are all over the Binance heist — already hailed as the largest cryptocurrency theft in history.
asserted
fingerprints → have → history
Unlike the majority of hacking groups, North Koreans opening move is often a confidence trick aimed at an employee.
asserted
move → open → employee
“They attack people, not code,” Lisa Zhao, security operation lead at cybersecurity firm SlowMist told The Post.
asserted
Zhao → attack → Post
In investigations SlowMist conducted in 2025, attackers posed as project teams and offered developers paid work fixing software.
asserted
attackers → conduct → software
Some offered money upfront to establish trust, others presented themselves as investors with trading software to test.
asserted
others → offer → software
Their trap was hidden in the work itself.
asserted
trap → hide → work
Attackers modified a real, publicly available software project and added malicious code.
asserted
Attackers → modify → code
“In many of the cases we encountered, no individual step looked like an attack — just helping with debugging, testing some code or changing a setting.”
Even employees who took precautions could be manipulated.
uncertain
who → encounter → precautions
Some ran the software in an isolated environment to protect the rest of their computer.
asserted
Some → run → computer
But then attackers asked for a seemingly reasonable adjustment to get their project working, which weakened that protection and gave them greater control, Zhao said.
asserted
Zhao → ask → control
From there, the hackers can make their way into their intended company’s network, steal credentials and get closer to the systems controlling its money, at this point using the company’s own tools to help disguise their activity.
asserted
hackers → make → activity
Zhao said her team observed links between the stolen Binance funds and IP addresses associated with earlier North Korea thefts.
asserted
team → say → thefts
“We detected links between the Binance hackers’ funds and addresses involved in the Phemex theft in early 2025, which we already linked to North Korean hackers,” Zhao told The Post.
asserted
Zhao → detect → Post
Blockchain intelligence firm TRM Labs separately attributed the attack to North Korea’s state-backed TraderTraitor operation, with high confidence, also citing similarities to earlier heists.
asserted
Labs → attribute → heists
What sets North Korea’s state-backed hackers apart from ordinary cybercriminals is their mission.
asserted
sets → set → cybercriminals
Other hackers steal for themselves, but the North Korea steals for the regime, headed by Supreme Leader Kim Jong Un.
asserted
Korea → steal → Un
US Treasury officials have linked North Korea’s cyber theft to funding its weapons programs.
asserted
officials → link → programs
Zhao says the attackers’ strengths combine patience, organization and an established ability to move and launder stolen cryptocurrency.
asserted
strengths → say → cryptocurrency
“Their money laundering infrastructure is well developed…
asserted
infrastructure → develop → ?
They move the funds fast between digital wallets and swap it to other cryptocurrencies, making it very difficult to stop them,” she said.
asserted
she → move → them
SlowMist founder Yu Xuan warned North Korean hack groups — such as Lazarus Group, Bluenoroff, and Andariel, according to feds — use other countries as gateways to their targets, for example hacking into a US system, then going from there to target Europe or Japan.
uncertain
groups → warn → Europe
“The common perception of North Korea is that it is poor and cut off from the world, but these kinds of hacking groups can [get into] computers belonging to people already in the United States to carry out attacks,” he said.
asserted
he → cut → attacks
“The activity is supported by the state, and their network can still have many stepping stones that allow it to reach any corner of the world.
asserted
it → support → world
To make things worse — AI can make the work behind those attacks faster and cheaper, from writing malicious code to preparing its delivery.
asserted
work → make → delivery
“A hacking group that might previously have focused on roughly five to 10 targets over six months or a year might now be able to focus on 50 to 100,” Xuan said.
uncertain
Xuan → focus → 100
“Many things that previously required manually writing code or people carrying out repetitive tasks can now be done much more efficiently with AI.”
asserted
people → require → AI
Microsoft reported this week that several North Korean threat groups had incorporated AI into operations, including deceptive recruiting material, fabricated identities and malicious-code development.
asserted
groups → report → material
Attackers can also exploit employees’ fear of admitting a mistake.
asserted
Attackers → exploit → mistake
“Some employees who had been deceived would actively delete relevant records because they were afraid of being held responsible.
asserted
they → deceive → records
They would also fail to report the incident promptly, making investigation and evidence collection very difficult,” Zhao said.
asserted
Zhao → fail → incident
“That exploitation of human nature surprised me more than their technical methods.”
asserted
exploitation → surprise → methods
Binance did not confirm North Korean involvement in its response to The Post.
asserted
Binance → confirm → Post
The company has said it is working with law enforcement to identify the criminals and will cover all hacked losses with company funds.
asserted
it → say → funds
“Your assets are safe,” co-CEO Richard Teng said in a statement supplied by the company.
asserted
Teng → say → company
The Aporia
