The founder of Binance, Changpeng Zhao (CZ), has raised concerns over the advanced techniques North Korean hackers are using to steal from cryptocurrency exchanges worldwide.
In a detailed post on X, Zhao described the hackers as “advanced, creative, and patient,” warning that their methods exploit both technical flaws and human weaknesses.
Fake Job Applications and Insider Threats
According to Zhao, one of the hackers’ most common strategies involves posing as job candidates. By applying for positions in development, security, and finance, they attempt to secure insider access.
In other cases, the hackers pose as employers, luring unsuspecting exchange staff into fake interviews. They claim to encounter Zoom issues and then send malicious “updates” or “sample code,” which installs viruses on victims’ devices.
Bribery and Customer Support Exploits
Zhao revealed that hackers also pose as crypto platform users, embedding viruses in links sent through customer support requests.
Additionally, the groups have bribed employees and outsourced service providers to gain access to sensitive exchange systems. He referenced a case where an Indian outsourcing firm was hacked, leading to a $400 million loss at a U.S. crypto exchange.
“The list goes on,” Zhao warned, urging crypto companies to screen candidates carefully and train employees not to download unverified files.
North Korea’s Billion-Dollar Crypto Heists
Zhao’s warning echoes findings by global security agencies, which have repeatedly linked North Korean hacking groups, particularly the Lazarus Group, to major crypto thefts.
According to Chainalysis, crypto hacking surged in 2024, with total funds stolen rising 21.07% year-over-year to $2.2 billion.
Key findings include:
- 61% of stolen funds ($1.34 billion) were linked to North Korean groups.
- A total of 47 incidents were attributed to state-sponsored hackers.
- Attacks increasingly exceeded $100 million per exploit.
These cybercrimes are believed to fund North Korea’s weapons programs and evade international sanctions.
Remote IT Contractors and Global Breaches
The report also highlighted how North Korean operatives infiltrate crypto and Web3 firms by:
- Using false identities
- Exploiting remote work opportunities
- Acting as third-party intermediaries
In one case, the U.S. Department of Justice indicted 14 North Korean nationals who posed as remote IT contractors at American firms, stealing proprietary information and generating over $88 million.
The Urgent Call for Stronger Cybersecurity
With regulatory pressure and investor scrutiny mounting, Zhao’s warning underscores the need for crypto exchanges to:
- Strengthen cyber hygiene
- Improve employee training
- Rigorously vet job applicants and vendors
As North Korean hackers continue to escalate their attacks, the crypto industry’s security standards will be pivotal in protecting both exchanges and investors from billion-dollar losses.
