More than $6.26 billion was moved out of Binance hot wallets across nine chains in the early hours of Oct. 30, 2026. A day later, the U.S. Federal Bureau of Investigation said North Korean hacking groups were involved in the theft, while Donald Trump said the U.S. would engage with North Korea if the attribution was confirmed.
Statistics cited by Deep Tide TechFlow put the broader picture in sharper focus. Between 2017 and 2026, hackers linked to Lazarus and North Korea were involved in 37 crypto theft cases with an estimated combined value of about $11.817 billion. The arc runs from the $7 million theft from South Korean exchange Bithumb in 2017 to the multibillion-dollar Binance incident in 2026.
A PDF, a forgotten permission, and $620 million gone
In early 2022, a senior engineer at Sky Mavis, the company behind Axie Infinity, received a LinkedIn message from someone posing as a recruiter. The compensation package looked attractive. After several rounds of interviews that appeared legitimate, the engineer received an offer letter in PDF form. Once the file was opened, spyware entered Sky Mavis’ internal systems.
At the time, Ronin Bridge used a proof-of-authority setup with nine validator nodes, and five signatures were required to approve withdrawals. The attackers used the compromised engineer’s machine to move into Sky Mavis’ IT infrastructure and obtained four validator keys. The fifth signature came from an older weakness that had never been fully closed. In November 2021, Sky Mavis had asked Axie DAO to help sign transactions during a period of heavy load. That temporary authorization was discontinued in December, but the access itself was never revoked.
In March 2022, $620 million disappeared from Ronin Bridge. One month later, the FBI attributed the attack to North Korea’s Lazarus Group. The report reduces the chain of events to three elements: a fake offer, a forgotten authorization, and a loss measured in hundreds of millions of dollars.
The same script kept returning, even as the methods evolved. Harmony’s Horizon Bridge lost $100 million in June 2022 after attackers posed as blockchain developers and gained internal access. In 2023, Atomic Wallet, Alphapo, CoinsPaid, and Stake.com were hit in succession, with combined losses above $238 million. In July 2024, Indian exchange WazirX was breached for $235 million.
The techniques were not identical. The underlying logic, the report says, was strikingly consistent: find a person, deceive that person, and use that person to open a door.
Bybit and Binance pushed the scale higher
That approach reached a new level in February 2025, when $1.5 billion was moved from a Bybit cold wallet. Paradigm security researcher samczsun said in his review that the attackers did not directly breach Bybit. Instead, they penetrated the infrastructure of Safe{Wallet}, the multisig wallet service provider, planted malicious code there, and targeted Bybit’s cold-wallet signing flow. In that setup, even strong internal controls at Bybit would not have been enough if the upstream supply chain had already been compromised.
Eight months later, Binance became the next target. Binance said after its investigation that an operations engineer’s laptop had been compromised, giving attackers a path into internal systems. They then used EIP-7702 to make the hot wallet sign a delegated authorization. Chinese on-chain analyst Shenyu described the attack contract in blunt terms: 「The attacker’s program recognizes only one master and does only one thing: move money.」
From Ronin to Bybit to Binance, the size of a single attack climbed from roughly $600 million to $1.5 billion and then to more than $6.2 billion. The report’s conclusion on that sequence is simple: each case began with a person, and social engineering remained central.
North Korean IT workers inside crypto companies
If Lazarus-style external attacks resemble forced entry, the infiltration by North Korean IT workers looks more like walking through the front door.
In October 2024, CoinDesk published an investigation that tracked blockchain payment records and internal leads. It found that more than 24 crypto companies had unknowingly hired North Korean IT workers, and at least 12 companies later confirmed that suspected North Korean nationals had appeared on their employee rosters. The projects named in the report included Cosmos Hub, Injective, ZeroLend, Fantom, Sushi, Yearn Finance, and Truflation.
MetaMask security researcher Taylor Monahan said at least 40 DeFi protocols had employed North Korean IT workers at some point over a seven-year span. According to the report, these workers used forged passports, visas, and carefully constructed resumes to pass screening, applying through Telegram, Discord, and Indeed. They targeted startups with loose hiring processes and crypto-based payrolls, and they rarely turned on cameras during remote work.
The United Nations has estimated that North Korean IT workers generate as much as $600 million a year for the regime, while individuals keep only 10% to 30% of that income.
A textbook case came in March 2024 with Munchables, an NFT game on Blast. The project hired a developer using the alias 「Werewolves0943」. On-chain investigator ZachXBT later said the developer was a North Korean operative who used development privileges to drain 17,400 ETH, worth about $62 million. The story then took an unusual turn. Under pressure from Blast founder Pacman and the broader community, the developer handed over all private keys within eight hours, and the stolen funds were fully returned. The report says no one knows why the money was returned, though one theory was that keeping the funds after being exposed would have created bigger problems.
Sushi was less fortunate. In September 2021, about $3 million was stolen from the Sushi/MISO platform. A later investigation found that two former contractors using the aliases 「Anthony Keller」 and 「Sava Grujic」 still had repository access after they were fired. Sushi later hired another suspected North Korean contractor, 「Gary Lee」.
In 2023, Truflation founder Stefan Rust discovered that five suspected North Korean workers were on his team, more than one-third of the company’s staff. The company was later hit by a private-key leak attack worth about $5 million.
CrowdStrike said North Korean IT workers infiltrated more than 320 companies over a 12-month period, up about 220% year over year. The report says they used false identities, hired people inside the U.S. to set up multiple computers for centralized remote work in order to fake location, and relied on generative AI during video interviews. Security firm KnowBe4 said it, too, had hired an employee through a standard process who began deploying malware immediately after starting work.
A revealing interview
In August 2026, a Korean American journalist posed as a recruiter named 「Sophie Wang」 and interviewed a suspected state-level North Korean hacker over video, with help from MetaMask security researcher Taylor Monahan, Nick Bax of SEAL Alliance, and Ump Labs.
The candidate called himself 「Justin Lim」 and claimed to live in Long Beach, California. His accent, however, was judged to sound Korean. Based on on-chain clues and identity records, the report says his real base was likely Vladivostok, Russia, and that he had stolen about $2.7 million from MetaPlay in 2022.
During the interview, he showed strong technical ability. He explained how to fork the Velas network and make The Graph run in a compatible way. When asked about OpenSea’s Seaport protocol and Uniswap v4, he pulled up documentation on the spot and analyzed it. The report notes one small but telling moment: when the interviewer mentioned North Korea’s $1.5 billion theft from Bybit, he smiled for the only time in the entire interview.
The final question ended the exchange. The interviewer asked him to say something negative about Kim Jong Un. After a period of silence, he left the Zoom call. He later said the network was unstable and asked to continue on Discord or Telegram. Pressed again, he replied only: 「I don’t know much about this person.」
The report says that in North Korea, openly criticizing the country’s top leader can lead to three generations of a family being sent to a political prison camp. Security circles later began recommending this as a hiring screen: ask candidates to make a negative comment about Kim Jong Un, and many North Korean developers will avoid answering.
The long buildout of a cyberwar system
Defector Jang Se-yul told Business Insider that North Korea’s cyberwar program dates back to the 1980s and carried the internal codename 「Secret War」. In his account, Pyongyang recognized early that cyber operations offered a relatively cheap and high-return asymmetric weapon against the combined conventional strength of U.S. and South Korean forces.
Training a North Korean hacker takes about nine years, according to the report. The pipeline begins at Kim Chaek University of Technology, formerly called the University of Automation, which admits 100 students each year from roughly 5,000 applicants. Political background is the first filter. North Korea’s songbun system divides citizens into three main classes and 56 subcategories, all recorded in household registration files.
Students take six 90-minute classes a day, studying programming languages and operating systems, digging into Windows architecture, and writing malware on their own rather than relying on ready-made tools. After graduation, they are assigned to mission groups focused on state targets and spend about two years overseas under the cover of legitimate employment, learning local language and culture.
Jang said the compensation is unusually high by North Korean standards, reaching as much as $2,000 a month, or twice the salary of a North Korean ambassador. Rewards can also include an apartment in Pyongyang larger than 185 square meters and the right to move one’s family into the capital. 「The cost of training hackers is extremely low,」 he said. 「That is why even a poor country can invest heavily in this field.」 He added: 「This is a war that does not require gunfire.」
Beyond Lazarus: one adversary, many labels
The U.S. Treasury sanctioned Lazarus Group, BlueNoroff, and Andariel in 2019, saying all three were controlled by North Korea’s Reconnaissance General Bureau, or RGB. Even so, the report argues that 「Lazarus」 is often just an umbrella term used from the outside for a much larger state cyber apparatus.
In analysis published after the Bybit incident, samczsun mapped several branches inside that network:
- TraderTraitor: focused on exchanges, custodians, and wallet systems, often using spear-phishing and fake job offers. Ronin, WazirX, and Bybit were attributed to this team in the report.
- AppleJeus (Citrine Sleet): a supply-chain operator that develops trojanized software around crypto use cases. Its 2024 intrusion into Radiant Capital was cited as a representative case. The group also used the Chromium zero-day CVE-2024-7971 to deploy the FudModule rootkit.
- BlueNoroff (Sapphire Sleet): originally focused on banks and the SWIFT system. In 2016, it nearly stole $1 billion from Bangladesh Bank, though the amount actually obtained was $81 million. It has since shifted heavily toward crypto and venture capital targets.
- Famous Chollima: specializes in internal infiltration by entering tech and crypto firms under false identities. The report says the more than 320 companies tracked by CrowdStrike were mainly tied to this team.
- DangerousPassword: relies on lower-cost mass operations such as phishing emails and fake video-call applications.
The report adds that these branches overlap heavily in personnel, tools, and infrastructure, while security firms often use different names for the same adversary. Diamond Sleet, UNC4899, Contagious Interview, and Wagemole are among the labels mentioned.
AI is now part of the attack chain
After the Binance incident, Elon Musk posted on X: 「Everyday is Zeroday」. The report places that remark next to a dedicated study from Microsoft’s threat intelligence team. According to Microsoft, three of North Korea’s eight active major hacking groups have already deeply integrated AI tools into routine attack workflows and reached the highest level in Microsoft’s cyber-threat AI maturity model.
In the report’s telling, AI is no longer limited to side experiments. It now spans reconnaissance, social-engineering lures, identity disguise, malware writing, and software supply-chain poisoning. Tasks that once took weeks to prepare, including phishing emails, fake resumes, and malicious code, can now be generated at scale and iterated automatically.
From Bithumb’s $7 million loss to Ronin’s $620 million, from Bybit’s $1.5 billion to Binance’s more than $6.2 billion, the size of the thefts has risen sharply. The article ends on a blunt point: the crypto industry is not facing isolated criminals, but the full cyberwar capacity of a nuclear-armed state, and that adversary is getting stronger.
