Skip to content

AI & Automation1 min read

North Korean hackers stole $6.3 billion from Binance

A TikTok report claims a fraudulent recruitment scheme allowed hackers to drain billions from cryptocurrency hot wallets.

by Fini MironFounder @ Balkaris
An abstract composition printed flat in deep charcoal, bone white, warm mid grey and bright electric lime green: four large rectangles lying flat and overlapping like sheets of paper on a table, each offset slightly to the right of the one beneath it.
Drawn for this article on our own machine. It is not a photograph.

According to elenanisonoff on TikTok, North Korean hackers stole $6.3 billion from the cryptocurrency exchange Binance. The attack began in June when an engineer downloaded a tampered AI coding tool, but the primary breach occurred later through a fake job interview process. By using a fraudulent recruitment scheme, the hackers gained access to a work laptop and used internal AI tools to compromise engineer accounts. On October 29th, the group executed a heist that drained billions from hot wallets in approximately 20 minutes.

The first 90 seconds of the video this was written from, by @elenanisonoff. See it on TikTok.

Why it matters

This incident demonstrates that AI tools are no longer just assets for productivity; they are active vectors for sophisticated social engineering. For a Swiss business, the risk shifts from simple software vulnerabilities to the manipulation of human trust through highly convincing, AI-assisted personas. Relying on automated tools for development or recruitment requires a higher standard of verification because the tools themselves can be used to bypass traditional security layers.

  • Software deployment permissions must be strictly decoupled from individual user devices to prevent single-point failures.
  • Internal AI tools require independent security monitoring to detect unauthorised use by compromised accounts.
  • Employee training must evolve beyond password hygiene to include the detection of deepfake identities in digital communications.

What to watch

You must scrutinise the origin of any third-party software or coding assignments provided during external interactions. Traditional security software often fails to recognise sophisticated malware embedded in seemingly legitimate files. Businesses should enforce strict separation between personal recruitment processes and company hardware. As AI makes fraudulent personas more convincing, manual verification of a company's identity remains a necessary safeguard against social engineering.

Within a year, automated voice and video spoofing will likely bypass standard remote checks. This will happen once real-time latency in generative models reaches zero.

Key takeaways

  • AI tools serve as active vectors for social engineering.
  • Software deployment permissions must be decoupled from user devices.
  • Manual identity verification remains necessary as deepfakes improve.

Frequently asked

How can we protect our development environment from similar attacks?

You should implement strict separation between personal recruitment processes and company hardware, while ensuring deployment permissions are not tied to individual devices.

When will remote identity checks become obsolete?

Standard remote checks will likely be bypassed within a year once real-time latency in generative models reaches zero.