North Korean Hackers Steal $1.6B from Crypto Sector in 2025

Binance has raised alarms over the growing cyber threat posed by North Korean hackers targeting the cryptocurrency industry. According to the exchange’s Chief Security Officer, Jimmy Su, these hackers are employing increasingly sophisticated tactics, including deepfake technology and AI-generated identities, to infiltrate legitimate roles within crypto firms [1]. The Lazarus Group, a state-affiliated hacking collective from North Korea, has been identified as a key player in these operations [2].

The infiltration methods typically begin with the creation of fake job applications. North Korean hackers fabricate resumes, social security numbers, and even entire personas to pass as qualified candidates on remote hiring platforms. One such case, uncovered by blockchain analyst ZachXBT, revealed that a North Korean IT team used over 30 fake identities to secure developer roles on platforms like Upwork and LinkedIn [3]. These individuals operated under names such as “Henry Zhang” and engaged in tasks for their employers without raising suspicion [4].

The threat extends beyond the hiring process. Once inside a company, these hackers gain access to internal systems and files. In one instance, a compromised device provided access to weekly reports and expense spreadsheets detailing the use of AI subscriptions, proxies, and payment wallets [5]. These activities have already resulted in significant financial losses. A wallet address linked to the North Korean team was connected to the $680,000 exploit of the Favrr project in June 2025 [6]. The project’s CTO, “Alex Hong,” was found to have an unverifiable work history and recently deleted LinkedIn profiles, further highlighting the deception involved [7].

The broader implications of these cyber operations are significant. North Korean hackers have reportedly drained $1.6 billion in digital assets from the crypto sector in the first half of 2025 alone [8]. The attacks target major cryptocurrencies like ETH and BTC, posing a systemic risk to the industry. Financial losses not only impact individual projects but also increase regulatory scrutiny and call for stronger cybersecurity protocols across the sector [9].

Jimmy Su emphasized the need for more robust hiring practices, including AI-based verification and tighter background checks. He noted that many hiring teams tend to become defensive or dismissive when alerts are raised, which can delay response times and allow breaches to go unnoticed [1]. Binance has since enhanced its internal security measures to detect and block fake applications from North Korean actors [2].

The rise in these cyber threats is closely tied to geopolitical developments and international sanctions against North Korea. As the country seeks alternative means of generating revenue, cybercrime has become a strategic tool. The persistence and adaptability of North Korean hackers suggest that the threat will continue to evolve unless the industry takes decisive action [3].

Experts warn that the lack of collaboration between private companies and service providers has allowed these actors to operate under the radar for extended periods [4]. With the infiltration tactics becoming more refined, the urgency to develop advanced countermeasures has never been greater [5].

Source:

[1] Binance

[2] PANews

[3] CryptoSlate

[4] Blockonomi

[5] AInvest

[6] Binance

[7] CoinTurk

[8] Binance Square

[9] AInvest