Binance hack shows how powerful North Korean hackers are

The huge hack at crypto exchange Binance shows how dangerous North Korean hackers have become. In the attack, about 6.3 billion dollars worth of crypto coins were stolen, the largest crypto theft ever.

Security experts suspect that the hackers are increasingly using artificial intelligence to prepare their attacks. This makes it more difficult for large crypto companies to protect themselves.

According to blockchain researcher TRM Labs, the North Korean hacker group TraderTraitor is behind the attack on Binance. The same group was held responsible by the US FBI for the hack at Bybit in February 2025, during which approximately $1.5 billion was stolen.

The working method of North Korean hackers has become increasingly advanced in recent years. Where in the past they mainly tried to steal cryptowallets' secret access keys, they now also focus on employees and complex systems with which transactions are approved.

According to security researchers, AI can play an important role in this. Hackers can use AI to gather information about employees, detect security vulnerabilities, and write persuasive phishing messages.

In this process, criminals pose as recruiters, for example, who approach employees of cryptocurrency companies with an attractive job. During a fake job interview, they then attempt to get the victim to install malicious software.

Whether AI was actually used in the attack on Binance has not yet been determined. However, researchers point out that the increasing complexity of these types of attacks is in line with the development of new hacking techniques.

According to TRM Labs, preparations for the Binance hack began at least 36 hours before the first crypto coins were stolen.

Subsequently, the attackers managed to siphon off billions of dollars in about twenty minutes via various blockchains, including those of Bitcoin, Ethereum, Solana, and XRP.

Binance suspects that a hacked laptop belonging to a software developer played a role. The attackers may have gained access to internal systems used to process withdrawals as a result.

The crypto exchange emphasizes that the investigation is still ongoing and that other vulnerabilities have also been discovered. It is not yet clear exactly how the hackers gained access.

According to Ari Redbord of TRM Labs, the attack represents a major turning point. It is not just about the enormous amount, but also about the speed and the manner in which the hackers managed to bypass various security systems.

Moreover, the attacks of North Korean hackers are not limited to Binance and Bybit. Crypto projects such as KelpDAO and Drift Protocol were also hit this year by large thefts attributed to North Korean groups.

According to TRM Labs, suspected North Korean hackers were already responsible for more than three-quarters of the value stolen from crypto hacks this year in April.

The record hack also raises questions about the security of crypto exchanges. According to Brian Peretti, former technology director at the U.S. Treasury Department, traditional banks typically have more controls to block suspicious cash flows.

Banks need to monitor transactions and have different layers of security. According to him, this makes it much more difficult to channel billions of dollars in a short time.

In the case of crypto coins, transactions can be carried out very quickly. That's an advantage of the technology, but also makes it possible to move large amounts within minutes if hackers gain access to the right systems.

Security expert Federico Charosky of Quorum Cyber also points out the enormous amounts of money that crypto exchanges manage. It is precisely this concentration that makes large trading platforms attractive to cybercriminals.

Western governments have long accused North Korea of using hacker groups to make money on its weapons programs.

One of the best-known groups is Lazarus, who, according to US authorities, has ties to North Korean intelligence. The group has been associated with international cyber attacks since 2007.