How North Koreas ruthless state sponsored hackers, main suspects in the $6.3B Binance heist, operate

Cybersecurity experts are pointing the finger at North Korea being behind the $6.3 billion Binance hack.The Hermit Kingdom’s hackers have a distinctive way of operating, and their fingerprints are all over the Binance heist — already hailed as the largest cryptocurrency theft in history.Unlike the majority of hacking groups, North Koreans opening move is often a confidence trick aimed at an employee.“They attack people, not code,” Lisa Zhao, security operation lead at cybersecurity firm SlowMist told The Post.In investigations SlowMist conducted in 2025, attackers posed as project teams and offered developers paid work fixing software.Some offered money upfront to establish trust, others presented themselves as investors with trading software to test.Their trap was hidden in the work itself.

Attackers modified a real, publicly available software project and added malicious code.“In many of the cases we encountered, no individual step looked like an attack — just helping with debugging, testing some code or changing a setting.”Even employees who took precautions could be manipulated.Some ran the software in an isolated environment to protect the rest of their computer.But then attackers asked for a seemingly reasonable adjustment to get their project working, which weakened that protection and gave them greater control, Zhao said.From there, the hackers can make their way into their intended company’s network, steal credentials and get closer to the systems controlling its money, at this point using the company’s own tools to help disguise their activity.Zhao said her team observed links between the stolen Binance funds and IP addresses associated with earlier North Korea thefts.“We detected links between the Binance hackers’ funds and addresses involved in the Phemex theft in early 2025, which we already linked to North Korean hackers,” Zhao told The Post.Blockchain intelligence firm TRM Labs separately attributed the attack to North Korea�...