Binance’s US$6.4 billion theft by North Korean (DPKR) actors started with an all-too-common tactic for DPRK’s hacking teams: employment fraud.
Chainalysis investigators have followed this strategy for years. It takes many forms; in the Binance case, DPRK workers lured their targets into applying for a phony job and infected their computer with malware.
But in other instances the attackers are themselves the applicants, either working under false pretenses to generate money for the regime, infecting corporate systems, or both.
Each instance can leave an on-chain footprint. Over the past 18 months, Chainalysis has attributed more than $14.3 million in losses to similar DPRK-linked fake interview and malware schemes.
These schemes have spanned a wide range of targets, from individual crypto holders and private wallets to organizations, protocols, and DAOs. Binance is now the latest in this string of cases.
“We’ve identified dozens of other job interview compromises that have led to wallet compromises” at the individual level, said Tom McLouth, a Chainalysis senior intelligence analyst. While losses in these earlier incidents ranged from tens of thousands to millions, the greater significance may lie in what they taught the attackers.
Across successive compromises, DPRK actors were “perfecting and evolving their methodology,” McLouth explained, refining their approach and potentially building the capabilities needed to target increasingly valuable victims. “That’s how you end up with the biggest heist in history.”
Seen in this context, the Binance attack may represent the culmination of months, or even years, of preparation and practice.
How a fake interview opened the door to Binance
On Tuesday, Binance released its initial findings into DPRK’s multi-stage attack against the exchange.
The attack began in September with an engineer receiving an invitation to a job interview. Binance revealed how attackers spent weeks building trust with a Binance employee, first approaching the employee through a legitimate job platform with a job opportunity.
After two rounds of interviews with a fictitious company, the Binance employee was asked to download an interview assignment that contained malicious code. This gave the attackers their initial foothold. From there, they deployed malware and exploited access to an internal AI tool to move deeper into Binance’s system.
While the scale of the breach was unprecedented, this method of entry was not. As Chainalysis Senior Manager of Global Services Alec Zebrick discussed this week, DPRK actors have repeatedly used what he calls “contagious interviews” to target employees with privileged access, exploiting their credentials and permissions to infiltrate organizations’ internal systems. This makes employees with access to sensitive infrastructure particularly valuable targets for these operations.
DPRK malware embeds itself in target systems
The Binance attack shows how a fake interview can provide an entry point into a major organization. Working with our partners, we’ve seen how attackers have cultivated this approach.
We have observed multiple cases in which victims had wallet private keys stolen from cloud storage following a malicious interview. In some cases, victims reported that the seed phrases had never been downloaded to the infected device, suggesting the attackers’ access extended beyond local files, potentially through compromised cloud credentials or browser sessions.
This is consistent with Microsoft’s reporting that DPRK malware searches infected systems for cryptocurrency seed phrases and password-manager artifacts. The credentials attackers collect early in an operation can open access to connected accounts well beyond the infected device.
In the Binance attack, that same basic playbook (using a fake interview to gain an initial foothold) ultimately enabled the attackers to move deeper into the exchange’s infrastructure.
Inside DPRK’s lucrative illicit employment ecosystem
The Binance attack is just one example of DPRK’s highly lucrative illicit employment ecosystem.
The DPRK uses a range of social engineering tactics, including other fake recruitment schemes as well as fraudulent IT employment to infiltrate companies.
Chainalysis has tracked several other ways DPRK actors are evolving and deploying these techniques. One emerging threat is the use of public blockchains to conceal malware instructions, a tactic we term Blockchain Dead Drops (BDDs).
Our research has identified a fivefold surge in these blockchain-assisted cyberattacks over the past year, a surge driven by nation-state actors and the potential use of open-weight AI models.
Our research indicates that North Korean actors began using these tactics, known variously as “Etherhiding” in early 2025 to maintain a link between the victim-computers compromised in their fake job interview schemes, and the malware command-and-control (C2) infrastructure. They do this because blockchain transactions are more resilient places to stage C2 infrastructure than relying on centralized or law enforcement-responsive hosting they can seize.
One DPRK technique that our on-chain analysis uncovered adds redundancy by spreading the C2 communication across two blockchains (TRON and Aptos) to direct infected devices to a third, BSC.
The attacker embeds pointers on TRON and Aptos that point to a transaction on BSC. If the infected machine can’t get what it needs from querying TRON, it turns to Aptos as a backup. Either way, it ends up where it needs to be, on BSC, where the payload is stored.
More recently DPRK has employed a tactic referred to as null receiver, where the same C2 communication instruction is embedded in a specially crafted address which is not actually controlled by anyone and is not designed to control any cryptocurrency assets. The address itself can be decoded into an instruction that is read by infected machines.
DPRK’s IT workers fraudulently embed in companies
On the other side of DPRK’s employment fraud playbook is its large-scale IT worker scheme. In this, North Korean operatives pose as legitimate job applicants to secure employment at companies around the world, earning salaries and potentially gain access to sensitive systems, while generating revenue for the state.
The United Nations estimates the DPRK’s IT worker ecosystem generates upwards of $600 million in annual revenue for the regime. This shadow workforce often intersects with crypto directly.
In many cases the IT workers have attempted to embed themselves in crypto companies. But they also use crypto to launder their illicit proceeds. Last month, we outlined a network of Russian and DPRK nationals who were sanctioned by the U.S. for their role in DPRK-run IT worker schemes.
Chainalysis closely tracks the inclusion of crypto addresses in sanctions designations targeting DPRK IT worker schemes, as well as open-source information on this threat.
The DPRK IT workers themselves are usually deployed overseas where they use different obfuscation techniques such as VPNs and stolen identity documents to gain employment at companies across the world. Once hired, these workers often request payment in stablecoins.
We’ve uncovered such on-chain activity, including in one case when wallets received regular payments indicative of salary payments.
Once their salaries are paid, DPRK IT workers transfer the crypto to intermediaries such as the Russian and DPRK nationals mentioned above.
How Chainalysis follows the money
The Binance case illustrates how North Korea continues to develop, test and refine a multi-pronged cybercrime playbook.
The same actors can exploit recruitment platforms, compromise corporate infrastructure, infiltrate legitimate businesses and use cryptocurrency to move the resulting proceeds. As their methods evolve, organizations must look beyond conventional cybersecurity controls and consider the financial infrastructure that enables these operations.
Chainalysis closely monitors how DPRK actors use cryptocurrency to generate revenue, move and consolidate funds, and launder illicit proceeds.
Blockchain intelligence is critical to that effort. When combined with traditional cybersecurity measures and threat intelligence, blockchain analysis can help organizations and investigators identify and freeze stolen funds, map DPRK’s expanding financial networks, and uncover procurement and payment patterns that can support sanctions investigations and enforcement.
The Binance investigation remains ongoing and we expect the stolen funds to continue moving in the coming days. Chainalysis is committed to supporting Binance and the wider industry as we trace the stolen funds, disrupt further laundering, and work to mitigate additional losses.
This analysis was first published by Chainalysis and is republished with kind permission. Read the longer-form original piece with FAQs here.
