This was described as a war that does not require gunfire.
In the early hours of Oct. 30, 2026, Binance hot wallets on nine chains were breached at the same time, with more than $6.26 billion moved out on-chain. On Oct. 31, the Federal Bureau of Investigation said North Korean hacking groups were involved in the Binance theft. Donald Trump said the U.S. would engage with North Korea if the attribution was confirmed.
TechFlowPost said that from 2017 to 2026, 37 crypto theft cases linked to Lazarus and other North Korea-connected actors reached an estimated $11.817 billion in value. The report frames the question in blunt terms: how did a country known for a closed network environment become one of the most aggressive predators in crypto in less than a decade?
A PDF and $620 million
At the start of 2022, a senior engineer at Sky Mavis, the company behind Axie Infinity, received a LinkedIn message from someone posing as a recruiter. The compensation package looked attractive. The interview process appeared formal and routine. In the end, the engineer received an offer letter in PDF format.
Opening that file let spyware slip into Sky Mavis’ internal systems.
Ronin Bridge used a proof-of-authority setup with nine validator nodes, and five signatures were required to approve withdrawals. After compromising the engineer’s machine, the attackers moved into Sky Mavis’ IT infrastructure and obtained four validator keys. The fifth signature came from an old permission that had never been fully removed. In November 2021, Sky Mavis had asked Axie DAO to help sign transactions during a period of heavy load. That temporary authorization was discontinued in December, but the access itself remained.
In March 2022, $620 million disappeared from Ronin Bridge. One month later, the FBI attributed the attack to North Korea’s Lazarus Group.
A fake job offer and a forgotten authorization were enough to drain hundreds of millions of dollars. The report says the same script kept returning, even as the methods became more refined.
In June 2022, Harmony’s Horizon Bridge lost $100 million after attackers posed as blockchain developers and gained internal access. In 2023, Atomic Wallet, Alphapo, CoinsPaid, and Stake.com were hit in sequence, with combined losses above $238 million. In July 2024, Indian exchange WazirX lost $235 million.
The techniques varied. The logic, the article argues, stayed largely the same: find one person, deceive that person, and use that person to open a door.
Bybit and Binance
In February 2025, $1.5 billion was moved out of a Bybit cold wallet. Paradigm security researcher samczsun said the attackers did not strike Bybit directly. Instead, they compromised the infrastructure of multisig wallet provider Safe{Wallet}, inserted malicious code there, and then targeted the signing flow used for Bybit’s cold wallet.
That point matters because it suggests a company can harden its own defenses and still fail if an upstream provider is breached.
Eight months later, Binance became the next target. According to Binance’s post-incident findings cited in the report, an operations engineer’s laptop was compromised first. The attackers then moved into internal systems and used EIP-7702 to make the hot wallet sign a delegated authorization. Chinese on-chain analyst Shenyu, reviewing the attack contract, summarized the logic this way: 「The attacker’s program recognizes only one master and does only one thing: move money.」
From Ronin to Bybit to Binance, the scale rose from roughly $600 million to $1.5 billion and then to $6.26 billion. The article treats those incidents as part of the same pattern. Each one began with a human target.
North Korean IT workers inside crypto firms
If Lazarus-style external attacks are forced entry, the report says North Korean IT worker infiltration looks more like walking through the front door.
In October 2024, CoinDesk published an investigation that said more than 24 crypto companies had unknowingly hired North Korean IT workers. At least 12 companies later confirmed that they had found suspected North Korean nationals on their staff lists. The projects named in the report included Cosmos Hub, Injective, ZeroLend, Fantom, Sushi, Yearn Finance, and Truflation.
MetaMask security researcher Taylor Monahan said at least 40 DeFi protocols had employed North Korean IT workers at some point over a seven-year period.
According to the article, these workers used forged passports, visas, and carefully prepared resumes to pass screening. They applied through Telegram, Discord, and Indeed, focusing on startups with loose hiring processes and crypto-based payrolls. During remote work, they rarely turned on their cameras. A United Nations estimate cited in the report said North Korean IT workers generate as much as $600 million a year for the regime, while individuals keep only 10% to 30%.
One of the clearest examples came in March 2024 with Munchables, an NFT game on Blast. The project hired a developer using the alias “Werewolves0943.” On-chain investigator ZachXBT later said the developer was a North Korean operative who used development privileges to pull out 17,400 ETH, worth about $62 million.
The case then took an unusual turn. Under pressure from Blast founder Pacman and the community, the developer handed over all private keys within eight hours and returned the full amount. The report says no one knows why the funds were returned. One theory mentioned in the article is that keeping the proceeds after being exposed would have created even bigger problems.
Other projects were not as fortunate. In September 2021, about $3 million was stolen from Sushi/MISO. The later investigation found that two former contractors using the aliases “Anthony Keller” and “Sava Grujic” still had repository access after they had been dismissed. Sushi later hired another suspected North Korean contractor, “Gary Lee.” In 2023, Truflation founder Stefan Rust found that five suspected North Korean workers were on his team, more than one-third of the company’s staff. The company was later hit by a private-key leak attack worth about $5 million.
CrowdStrike data cited in the report said North Korean IT workers infiltrated more than 320 companies in a 12-month period, up about 220% year over year. The article says they used false identities, hired people in the U.S. to maintain banks of computers for remote access in order to fake location, and relied on generative AI during video interviews. Security company KnowBe4 also said it discovered that a newly hired “employee,” who had passed a standard hiring process, began deploying malware immediately after starting work.
A video interview and one question
In August 2026, a Korean American journalist, working with MetaMask security researcher Taylor Monahan, SEAL Alliance’s Nick Bax, and Ump Labs, posed as a recruiter named “Sophie Wang” and interviewed a suspected North Korean state hacker over video.
The applicant called himself “Justin Lim” and claimed to live in Long Beach, California. His accent was judged to sound Korean. Based on on-chain clues and identity records, the report said his actual base was likely Vladivostok, Russia, and that he had stolen about $2.7 million from MetaPlay in 2022.
During the interview, he showed strong technical ability. He explained how to fork the Velas network and make The Graph run in a compatible way. When asked about OpenSea’s Seaport protocol and Uniswap v4, he pulled up documentation on the spot and worked through it.
When the interviewer mentioned North Korea’s $1.5 billion theft from Bybit, he smiled for the only time in the entire session. The interview ended on the final question. He was asked to say something negative about Kim Jong Un. After a pause, he left the Zoom call. He later said the network was unstable and asked to continue on Discord or Telegram. When pressed again, he replied only: 「I do not know much about this person.」
The article says that openly criticizing the country’s top leader in North Korea can lead to punishment extending across three generations. It adds that this question has since been recommended in parts of the security community as a hiring screen, because suspected North Korean developers almost always avoid answering it directly.
The “secret war”
North Korea’s cyber capability did not appear overnight. Defector Jang Se-yul told Business Insider that the country’s cyberwar program dates back to the 1980s and carried the internal codename “Secret War.” In his account, Pyongyang concluded early that cyber operations offered a low-cost, high-return asymmetric weapon against the combined military power of the U.S. and South Korea.
Training one North Korean hacker takes about nine years, according to the report. The pipeline begins at Kim Chaek University of Technology, formerly called the University of Automation, which admits 100 students each year from roughly 5,000 applicants. Political background is the first filter. North Korea’s “songbun” classification system divides citizens into three main classes and 56 subcategories, all recorded in household files.
Students take six 90-minute classes a day. They study programming languages and operating systems, dig into Windows architecture, and are required to write malware on their own rather than rely on ready-made tools.
After graduation, they are assigned to mission groups and sent abroad under the cover of legitimate employment for about two years to learn local language and culture. The compensation is unusually high by North Korean standards: as much as $2,000 a month, twice the salary of a North Korean ambassador. Rewards can also include an apartment in Pyongyang larger than 185 square meters and the right to move one’s family into the capital.
Jang said, 「The cost of training hackers is extremely low.」 He argued that this is why even a poor country can invest heavily in the field. In his view, cyber threats are more immediate and more dangerous than nuclear threats: 「This is a war that does not require gunfire.」
Lazarus as an umbrella label
In 2019, the U.S. Treasury sanctioned Lazarus Group, BlueNoroff, and Andariel, saying all three were controlled by North Korea’s Reconnaissance General Bureau, or RGB. The article argues, though, that “Lazarus” is really an outside label for a much larger state cyber apparatus.
After the Bybit incident, samczsun outlined several major branches inside that network:
- TraderTraitor: focused on exchanges, custodians, and wallet systems, using spear-phishing and fake job offers. The report places Ronin, WazirX, and Bybit in this cluster. It says the group usually does not rely on zero-day exploits and instead manipulates people.
- AppleJeus (Citrine Sleet): a supply-chain focused operation that develops trojanized software for crypto targets. The 2024 compromise of Radiant Capital is cited as a representative case. The group also used the Chromium zero-day CVE-2024-7971 to deploy the FudModule rootkit.
- BlueNoroff (Sapphire Sleet): originally known for attacks on banks and the SWIFT system. In 2016, it nearly stole $1 billion from Bangladesh Bank and actually obtained $81 million. The report says it has now shifted fully toward crypto and venture capital targets.
- Famous Chollima: specializes in entering tech and crypto firms under false identities to build internal access. The article says the 320 infiltrated companies tracked by CrowdStrike were mainly tied to this branch.
- DangerousPassword: a lower-cost, broad-distribution operation that leans on phishing emails and fake video-call applications.
The report notes that personnel, tools, and infrastructure overlap heavily across these branches, and naming conventions differ from one security firm to another. Diamond Sleet, UNC4899, Contagious Interview, and Wagemole may describe the same adversary under different masks.
AI and an asymmetric fight
After the Binance incident, Elon Musk posted on X: “Everyday is Zeroday.”
Microsoft Threat Intelligence said in a dedicated research report that three of North Korea’s eight active major hacking groups have already integrated AI tools deeply into daily attack workflows, reaching the highest level in Microsoft’s cyber-threat AI maturity model.
The article says AI is no longer limited to side experiments. It now spans reconnaissance, social-engineering lures, identity deception, malware writing, and software supply-chain poisoning. Tasks that once took weeks to prepare, including phishing emails, fake resumes, and malicious code, can now be generated at scale and iterated automatically.
Attackers need one opening. Defenders have to protect every opening. That is the asymmetry at the center of the report.
From the $7 million theft at Bithumb to the $620 million Ronin exploit, from the $1.5 billion Bybit theft to the $6.26 billion Binance breach, the numbers have climbed sharply. TechFlowPost’s conclusion is that the crypto industry is not facing isolated hackers, but the full cyberwar capacity of a nuclear-armed state, and that opponent is getting stronger.
