DPRK Hackers Perfected Their Fake Interview Playbook Over Dozens of Attacks Before Binance

Summary

• Binance disclosed that a DPRK fake employment scheme was behind the $6 billion heist: Attackers used a fabricated job opportunity and a series of fake interviews to target a Binance employee, turning a seemingly routine recruitment process into the entry point for the largest crypto theft in history.
• Smaller attacks may have helped DPRK hackers perfect their playbook: Chainalysis has attributed more than $14.3 million in losses over the past 18 months to similar DPRK-linked fake interview schemes. Our analysis suggests these earlier compromises allowed North Korean actors to refine their methods on small targets before deploying them against higher-value targets.
• The attack is part of DPRK’s wider illicit employment ecosystem: Fake interview schemes are just one component of North Korea’s lucrative ecosystem, which includes fraudulent IT employment schemes and crypto laundering. Chainalysis tracks these evolving tactics and the crypto infrastructure underpinning them.

Binance’s $6.4 billion theft by North Korean actors started with an all-too-common tactic for DPRK’s hacking teams: employment fraud.

Chainalysis investigators have followed this strategy for years. It takes many forms; in the Binance case, for example, DPRK workers lured their targets into applying for a phony job and infected their computer with malware instead. But in other instances the attackers are themselves the applicants, either working under false pretenses to generate money for the regime, infecting corporate systems, or both.

Each instance can leave an on-chain footprint. Over the past 18 months, Chainalysis has attributed more than $14.3 million in losses to similar DPRK-linked fake interview and malware schemes. These schemes have spanned a wide range of targets, from individual crypto holders and private wallets to organizations, protocols, and DAOs. Binance is now the latest in this string of cases.

“We’ve identified dozens of other job interview compromises that have led to wallet compromises” at the individual level, said Tom McLouth, our senior intelligence analyst. While losses in these earlier incidents ranged from tens of thousands to millions, the greater significance may lie in what they taught the attackers.

Across successive compromises, DPRK actors were “perfecting and evolving their methodology,” McLouth explained, refining their approach and potentially building the capabilities needed to target increasingly valuable victims. “That’s how you end up with the biggest heist in history.”

Seen in this context, the Binance attack may represent the culmination of months, or even years, of preparation and practice.

How a fake interview opened the door to Binance

On Tuesday, Binance released its initial findings into DPRK’s multi-stage attack against the exchange.

The attack began in September with an engineer receiving an invitation to a job interview. Binance revealed how attackers spent weeks building trust with a Binance employee, first approaching the employee through a legitimate job platform with a job opportunity. After two rounds of interviews with a fictitious company, the Binance employee was asked to download an interview assignment that contained malicious code. This gave the attackers their initial foothold. From there, they deployed malware and exploited access to an internal AI tool to move deeper into Binance’s system.

While the scale of the breach was unprecedented, this method of entry was not. ​​As Chainalysis Senior Manager of Global Services Alec Zebrick discussed this week, DPRK actors have repeatedly used what he calls “contagious interviews” to target employees with privileged access, exploiting their credentials and permissions to infiltrate organizations’ internal systems. This makes employees with access to sensitive infrastructure particularly valuable targets for these operations.

DPRK malware embeds itself in target systems

The Binance attack shows how a fake interview can provide an entry point into a major organization. Working with our partners, we’ve seen how attackers have cultivated this approach.

We have observed multiple cases in which victims had wallet private keys stolen from cloud storage following a malicious interview. In some cases, victims reported that the seed phrases had never been downloaded to the infected device, suggesting the attackers’ access extended beyond local files, potentially through compromised cloud credentials or browser sessions.

This is consistent with Microsoft’s reporting that DPRK malware searches infected systems for cryptocurrency seed phrases and password-manager artifacts. The credentials attackers collect early in an operation can open access to connected accounts well beyond the infected device. In the Binance attack, that same basic playbook (using a fake interview to gain an initial foothold) ultimately enabled the attackers to move deeper into the exchange’s infrastructure.

Inside DPRK’s lucrative illicit employment ecosystem

The Binance attack is one example of DPRK’s highly lucrative illicit employment ecosystem.

The DPRK uses a range of social engineering tactics, including other fake recruitment schemes as well as fraudulent IT employment to infiltrate companies.

Chainalysis has tracked several other ways DPRK actors are evolving and deploying these techniques. One emerging threat is the use of public blockchains to conceal malware instructions, a tactic we term Blockchain Dead Drops (BDDs). Our research has identified a fivefold surge in these blockchain-assisted cyberattacks over the past year, a surge driven by nation-state actors and the potential use of open-weight AI models.

Our research indicates that North Korean actors began using these tactics, known variously as “Etherhiding” in early 2025 to maintain a link between the victim-computers compromised in their fake job interview schemes, and the malware command-and-control (C2) infrastructure. They do this because blockchain transactions are more resilient places to store C2 than a centralized server that law enforcement can seize.

One DPRK technique that our on-chain analysis uncovered adds redundancy by spreading the C2 across two blockchains (TRON and Aptos) to direct infected devices to a third, BSC. The attacker embeds pointers on TRON and Aptos that point to a transaction on BSC. If the infected machine can’t get what it needs from querying TRON, it turns to Aptos as a backup. Either way, it ends up where it needs to be, on BSC, where the payload is stored.

DPRK’s IT workers fraudulently embed in companies

On the other side of DPRK’s employment fraud playbook is its large-scale IT worker scheme. In this, North Korean operatives pose as legitimate job applicants to secure employment at companies around the world, earning salaries and potentially gain access to sensitive systems, while generating revenue for the state.

The United Nations estimates the DPRK’s IT worker ecosystem generates upwards of $600 million in annual revenue for the regime. This shadow workforce often intersects with crypto directly. In many cases the IT workers have attempted to embed themselves in crypto companies. But they also use crypto to launder their illicit proceeds. Last month, we outlined a network of Russian and DPRK nationals who were sanctioned by the U.S. for their role in DPRK-run IT worker schemes.

Chainalysis closely tracks the inclusion of crypto addresses in sanctions designations targeting DPRK IT worker schemes, as well as open-source information on this threat.

The DPRK IT workers themselves are usually deployed overseas where they use different obfuscation techniques such as VPNs and stolen identity documents to gain employment at companies across the world. Once hired, these workers often request payment in stablecoins.

We’ve uncovered such on-chain activity, including in one case when wallets received regular payments indicative of salary payments.

Once their salaries are paid, DPRK IT workers transfer the crypto to intermediaries such as the Russian and DPRK nationals mentioned above.

How Chainalysis follows the money

The Binance case illustrates how North Korea continues to develop, test and refine a multi-pronged cybercrime playbook.

The same actors can exploit recruitment platforms, compromise corporate infrastructure, infiltrate legitimate businesses and use cryptocurrency to move the resulting proceeds. As their methods evolve, organizations must look beyond conventional cybersecurity controls and consider the financial infrastructure that enables these operations.

Chainalysis closely monitors how DPRK actors use cryptocurrency to generate revenue, move and consolidate funds, and launder illicit proceeds.

Blockchain intelligence is critical to that effort. When combined with traditional cybersecurity measures and threat intelligence, blockchain analysis can help organizations and investigators identify and freeze stolen funds, map DPRK’s expanding financial networks, and uncover procurement and payment patterns that can support sanctions investigations and enforcement.

The Binance investigation remains ongoing and we expect the stolen funds to continue moving in the coming days. Chainalysis is committed to supporting Binance and the wider industry as we trace the stolen funds, disrupt further laundering, and work to mitigate additional losses.

FAQs

How did North Korean hackers steal $6.4 billion from Binance?

The attack began with a fake job opportunity targeting a Binance employee. After building trust through multiple rounds of interviews with a fictitious company, attackers sent the employee a malicious coding assignment that infected their computer and gave them an initial foothold in Binance’s systems. They then deployed malware and exploited access to an internal AI tool to move deeper into the exchange’s infrastructure.

What are DPRK fake interview schemes?

DPRK fake interview schemes use fraudulent recruitment processes to compromise job candidates’ computers and gain access to sensitive systems or cryptocurrency wallets. Attackers may pose as recruiters or hiring managers, conduct seemingly legitimate interviews, and use malicious coding assignments or other downloads to deliver malware. Chainalysis refers to these operations as “contagious interviews.”

Have North Korean hackers used fake interviews in other crypto attacks?

Yes. Over the past 18 months, Chainalysis has attributed more than $14.3 million in losses to similar DPRK-linked fake interview and malware schemes. Targets have included individual crypto holders, private wallets, organizations, protocols, and DAOs. These earlier attacks may have helped DPRK actors refine their methods before pursuing larger targets.

How do fake job interviews help DPRK hackers infiltrate organizations?

Fake interviews can give attackers access to an employee’s device, credentials, and permissions. Employees with privileged access to sensitive infrastructure are particularly valuable targets because compromising their accounts can provide a path into an organization’s internal systems.

What is a DPRK illicit IT worker scheme?

North Korean operatives pose as legitimate job applicants, often using stolen identities and other obfuscation techniques, to secure remote employment at companies around the world. They earn salaries that generate revenue for the regime and may gain access to sensitive corporate systems. The United Nations estimates this ecosystem generates more than $600 million annually for North Korea.

How does North Korea use cryptocurrency in its cybercrime operations?

DPRK-linked actors use cryptocurrency both to receive proceeds from illicit employment and to move and launder funds from cyberattacks. IT workers may receive salaries in stablecoins before transferring funds to intermediaries. Hackers also exploit public blockchains to conceal malware instructions and maintain command-and-control infrastructure.

How does Chainalysis help track DPRK-linked cybercrime?

Chainalysis analyzes blockchain activity to identify how DPRK-linked actors receive, move, consolidate, and launder illicit funds. This intelligence can help investigators and organizations trace stolen cryptocurrency, identify intermediary networks, support sanctions investigations, and work to freeze funds where possible.

This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.

This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.

Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.