From a Single PDF to $6.3 Billion: How North Korean Hackers Took Over the Crypto World?

Author: Xiaobing, TechFlow

In the early hours of October 30, 2026, hot wallets across nine chains on Binance were simultaneously compromised, with over $6.26 billion transferred out on-chain.

On October 31, it was announced that the U.S. Federal Bureau of Investigation (FBI) identified a North Korean hacker group as involved in the Binance theft incident. Trump stated that if confirmed, the U.S. would engage in diplomatic negotiations with North Korea.

A single country has treated the entire cryptocurrency industry as an ATM.

According to TechFlow statistics, between 2017 and 2026, hackers linked to Lazarus and North Korea were involved in 37 cryptocurrency theft cases, totaling approximately $11.817 billion in estimated value.

Starting from the 2017 attack on South Korean exchange Bithumb that stole $7 million, to Binance losing billions overnight, how did a nation perceived as digitally isolated manage to transform from a peripheral player in cyberspace into the top predator in the crypto world in less than ten years?

A PDF Document, Six Hundred Million Dollars

In early 2022, a senior engineer at Sky Mavis, the parent company of the crypto game Axie Infinity, received a LinkedIn message from someone claiming to be a recruiter for a certain company, offering a highly attractive compensation package.

The engineer went through multiple rounds of interviews, and everything appeared completely legitimate. Eventually, he received an offer letter in PDF format. The moment he opened the file, spyware silently infiltrated Sky Mavis's internal systems.

Axie Infinity’s Ronin Bridge uses a proof-of-authority mechanism with nine validator nodes, requiring signatures from five nodes to approve withdrawals. Attackers penetrated Sky Mavis's IT infrastructure through the infected engineer's computer and obtained keys for four validators. The fifth signature came from a forgotten loophole: In November 2021, Sky Mavis had asked the Axie DAO to help sign during peak transaction loads. This temporary authorization was deactivated in December, but access rights were never revoked.

In March 2022, $620 million vanished from the Ronin Bridge. A month later, the FBI attributed the attack to North Korea's Lazarus Group.

A fake offer, a forgotten authorization, and $600 million stolen.

The Ronin playbook repeated itself, but the attackers' methods evolved.

In June 2022, the Harmony Horizon Bridge fell, with $100 million transferred away. Attackers posed as blockchain developers and gained system access under the guise of insiders. In 2023, Atomic Wallet, Alphapo, CoinsPaid, and Stake.com were breached in succession, resulting in cumulative losses exceeding $238 million. By July 2024, Indian exchange WazirX suffered a breach of $235 million.

While each attack used different techniques, the underlying logic remained shockingly consistent: find a person, deceive that person, and use them to open a door.

In February 2025, they pushed this methodology to new heights.

$1.5 billion was drained from Bybit's cold wallets. Paradigm security researcher samczsun's post-mortem revealed that attackers did not directly target Bybit; instead, they compromised the infrastructure of its multi-sig wallet provider, Safe{Wallet}, planting malicious code specifically targeting Bybit's cold wallet signing process. This means that even if Bybit's own security measures are flawless, breaching the upstream supply chain renders all defenses useless.

Eight months later, Binance became the latest prey.

Post-incident reports from Binance showed that a DevOps engineer's laptop was compromised. Attackers used this foothold to penetrate internal systems and leverage EIP-7702 to get the hot wallets to sign a delegation authorization. Shenyu's on-chain post-mortem dissected the attack contract's logic: "The attacker's program only recognizes one master and does one thing: transfers money."

From Ronin to Bybit to Binance, the scale of attacks jumped from $600 million to $1.5 billion, and then to $6.2 billion. Each time it was a victory for social engineering, and each time it started with a single person.

Your Colleague Might Be North Korean

If Lazarus's external attacks represent "breaking down the door," then the infiltration by North Korean IT workers represents "slipping inside."

In October 2024, CoinDesk released an investigative report that shocked the industry. Journalists tracked blockchain payment records and internal leads, discovering that over 24 cryptocurrency companies had unknowingly hired North Korean IT workers. At least 12 of these companies confirmed having found suspected North Korean employees on their staff lists. Projects named included Cosmos Hub, Injective, ZeroLend, Fantom, Sushi, Yearn Finance, and Truflation.

MetaMask security researcher Taylor Monahan revealed that at least 40 DeFi protocols had employed North Korean IT workers throughout their history, spanning a seven-year period.

These individuals passed screening using forged passports, visas, and meticulously crafted resumes, applying via Telegram, Discord, and Indeed. They targeted startup teams with loose hiring processes that paid in cryptocurrency, rarely turning on their cameras during remote work. The United Nations estimates that North Korean IT workers earn up to $600 million annually for the regime, with individuals keeping only 10% to 30%.

The Munchables incident in March 2024 provided a textbook example.

This NFT game built on the Blast chain hired a developer under the alias "Werewolves0943." On-chain investigator ZachXBT traced the individual back to being a North Korean spy. Exploiting development privileges, the developer siphoned 17,400 ETH from the project, valued at approximately $62 million.

The twist in the story occurred when, under pressure from Blast founder Pacman and the community, the developer surrendered all private keys within eight hours and fully returned the stolen funds. No one knows why he returned it. One theory suggests that maintaining possession of illicit funds after exposure would only invite greater trouble.

But Sushi's experience was not so fortunate.

In September 2021, the Sushi/MISO platform was hacked for approximately $3 million. Post-incident investigations revealed that two former contractors using aliases "Anthony Keller" and "Sava Grujic" retained code repository access even after being terminated. Sushi later also hired another suspected North Korean contractor named "Gary Lee." In 2023, Truflation founder Stefan Rust discovered five suspected North Korean workers on his team, accounting for more than a third of all employees. Subsequently, the company faced a private key leak attack worth around $5 million.

Data from CrowdStrike shows that North Korean IT workers penetrated over 320 companies within 12 months, representing a year-over-year increase of approximately 220%.

They used false identities, hired individuals within the U.S. to set up multiple computers for centralized remote work to spoof their geographic location, and used generative AI to pass video interviews.

Security firm KnowBe4 even discovered it had fallen victim themselves, when an "employee" who joined through standard hiring procedures immediately began deploying malware upon clocking in.

Unable to Say a Single Bad Word About Kim Jong Un

What kind of people are North Korean hackers actually?

In August 2026, a Korean-American journalist, with assistance from MetaMask security researcher Taylor Monahan, SEAL Alliance's Nick Bax, and Ump Labs, posed as a recruiter named "Sophie Wang" and conducted a video interview with a suspected North Korean state-level hacker.

The applicant claimed to be "Justin Lim" and said he lived in Long Beach, California, but his accent was identified as Korean. On-chain clues and identity data indicated his actual residence was very likely Vladivostok, Russia. He had previously stolen approximately $2.7 million from MetaPlay in 2022.

During the interview, he demonstrated solid technical skills: explaining how to fork the Velas network and make The Graph run compatibly, and pulling up documentation on the spot to analyze unfamiliar protocols like OpenSea Seaport and Uniswap v4.

When the interviewer mentioned North Korea stealing $1.5 billion from Bybit, he displayed the only smile of the entire interview.

The final question ended everything. The interviewer asked him to say something negative about Kim Jong Un. After a silence, he exited Zoom. He subsequently requested to switch to Discord or Telegram for further communication, citing "unstable internet." When pressed again, he simply replied: "Not much knowledge about this person."

In North Korea, openly criticizing the supreme leader can result in three generations being sent to political prison camps. This test has since been widely recommended by the security community as a recruitment screening method: requiring candidates to make negative remarks about Kim Jong Un causes almost every North Korean developer to dodge or refuse.

Secret War

North Korea's cyberattack capabilities were not built overnight.

According to defector Jang Se-yul, who shared details with Business Insider, North Korea's cyber warfare program dates back to the 1980s, carrying the internal codename "Secret War." The Kim dynasty leadership realized early on that conventional military forces pale in comparison to the U.S.-South Korean alliance, making cyber warfare the lowest-cost, highest-return asymmetric weapon.

Training a North Korean hacker takes roughly nine years. It begins at Kim Ch'aek University of Technology (formerly the University of Automation), which admits 100 students annually from a pool of approximately 5,000 applicants. Screening criteria prioritize political lineage. North Korea's loyalty classification system divides citizens into three primary classes and 56 subcategories, recorded in household archives. Students attend six 90-minute classes daily, studying programming languages and operating systems, diving deep into Windows architecture, and are required to independently write malware without relying on off-the-shelf tools.

Upon graduation, hackers are assigned to operation groups targeting specific states, going undercover overseas as legitimate corporate employees for about two years to learn local languages and culture. Compensation is highly lucrative: up to $2,000 monthly, twice a North Korean ambassador's salary. Additional rewards include an apartment in Pyongyang larger than 185 square meters and permission for their families to relocate to the capital.

"The cost to train hackers is extremely low," Jang Se-yul said. "This is why even a poor country can pour massive resources into this sector."

In his view, cyber threats are more direct and dangerous than nuclear ones: "This is a war fought without firing a shot."

Ghost Empire

The U.S. Treasury sanctioned three entities in 2019—Lazarus Group, BlueNoroff, and Andariel—noting they are all controlled by North Korea's Reconnaissance General Bureau (RGB). However, "Lazarus" is merely an umbrella term coined by outsiders for a vast state-sponsored cyberattack apparatus.

In analysis released after the Bybit incident, Paradigm security researcher samczsun mapped out this intricate organizational network:

TraderTraitor: High-value hunters. Specializing in exchanges, custodians, and wallet systems, experts in spear phishing and fake job offers. The Ronin, WazirX, and Bybit breaches all originated from this unit. They typically avoid zero-day exploits, preferring to manipulate "people" to pry open systems.

AppleJeus (Citrine Sleet): Supply chain assassins. They develop trojanized software tailored for crypto scenarios, exemplified by their 2024 compromise of Radiant Capital. They also deploy the FudModule Rootkit exploiting Chromium zero-day vulnerability CVE-2024-7971.

BlueNoroff (Sapphire Sleet): Financial hunters. Early targets included banks and SWIFT systems; in 2016, they nearly looted $1 billion from Bangladesh Bank (actually securing $81 million). They have now fully pivoted to cryptocurrencies and venture capital sectors.

Famous Chollima: Infiltrators. They obtain employment at tech and crypto firms using fake identities, building internal penetration capabilities. Of the 320 companies tracked by CrowdStrike, most compromises stem from this unit.

DangerousPassword: Low-cost broadnetters. They deploy phishing emails and fake video conferencing apps. Their methods are simple but rely on high volume.

There is significant overlap in personnel, tools, and infrastructure across these branches, and different security firms assign varying names. Others include Diamond Sleet, UNC4899, Contagious Interview, and Wagemole.

One adversary, a dozen aliases, numerous masks.

Asymmetric Warfare

Following the Binance incident, Elon Musk posted on X: "Everyday is Zeroday."

This is not mere rhetoric. A specialized research report published by Microsoft Threat Intelligence reveals that among North Korea's 8 active major hacking groups, 3 have already completed the deep integration of AI tools into routine attack workflows, reaching the highest level in Microsoft's network threat AI application maturity model.

AI involvement has moved beyond peripheral experiments to comprehensively cover the entire chain: initial reconnaissance, social engineering phishing, identity spoofing, malware coding, and even software supply chain poisoning. In other words, phishing emails, fabricated resumes, and malicious code that once required weeks to prepare can now be generated in bulk and automatically iterated.

Attackers only need to find one flaw, while defenders must protect against all flaws. This is asymmetric warfare.

From Bithumb's $7 million to Ronin's $620 million, from Bybit's $1.5 billion to Binance's $6.2 billion, attack scales are growing exponentially. On the other end of this curve lies a nation with a per capita GDP under $2,000, a group of youths who began nine years of training at age 17, and a state apparatus that has served the "secret war" for four decades.

The cryptocurrency industry must face a hard truth: standing opposite them is the full cyber warfare capability of a nuclear-armed state—an adversary that is continually growing stronger.