North Korean Hackers Use AI Tools to Steal Credentials, Withdraw Crypto from Binance
North Korean hackers were found to have abused artificial intelligence (AI) tools to steal authentication credentials (cryptographic keys verifying access rights) and then withdraw virtual assets from Binance, the world's largest cryptocurrency exchange. In its initial investigation report released on Friday (local time), Binance explained that a multi-stage attack had been carried out over five months starting in June, combining a supply chain attack (an attack that secretly infiltrates by tampering with developer tools) and social engineering (an attack exploiting human psychology).
The attack began in June. The hackers induced Engineer A, who was in charge of developing and operating a crypto wallet at Binance, to download a tampered development tool. Although Binance's security team detected the anomaly and took steps such as replacing devices and renewing credentials, the personal information of staff in the wallet infrastructure (system-based facilities) team had already been exposed to the hackers.
About three months later, the attackers changed their approach. In September, the hackers approached Engineer B through a job-hunting platform and proceeded with a fake recruitment process. In the first video interview, the person playing the interviewer even shared their own social media accounts to gain B's trust. In the second interview, a person posing as the CEO had B download software containing malware onto his work computer under the pretext of completing an assignment.
This malware exploited a 'zero-day' vulnerability undetectable by security tools to swap out a legitimate development tool for a malicious version. On the 20th of last month, the company's internal AI tool was abused via B's infected computer. Through this channel, the hackers progressively gained control over A and Engineer C, and secured the deployment credential (a container deployment permission token) held by A.
The asset withdrawal took place on the 29th of last month. The hackers logged into C's computer and deployed a program of their own making using A's credentials. Starting at 8:05 p.m. UTC (5:05 a.m. on the 30th, Korean time), 233.46 million XRP tokens were withdrawn without authorization over four minutes, followed by transfers of 970,500 Solana (SOL), 44.2 million Optimism (OP), 18,270 Bitcoin, and 2,961.9 Ethereum.
Notably, the attack on the Ethereum network abused an authorization capability known as 'EIP-7702.' Using 50 pre-prepared signatures, the hackers obtained delegated authorization for the asset withdrawals, bypassing the normal withdrawal infrastructure. Binance reset the EIP-7702 delegation code about four hours after the attack began, at 0:10 a.m. on the 30th (9:10 a.m. Korean time), preventing further leaks—but a substantial amount of cryptocurrency had already been withdrawn.
The total value of virtual assets affected by the incident is 6.34 billion dollars (about 8.4 trillion won). Of this, 2.85 billion dollars (roughly 3.8 trillion won) has been frozen or blocked through cooperation between exchanges and issuers. Binance said it has compensated more than 98 percent of the losses with its own funds, the Secure Asset Fund for Users (SAFU), and its futures insurance fund.
According to Binance, 57 cyber threat incidents suspected of being linked to North Korea were detected and blocked in 2026 alone. Binance has rebuilt the compromised wallets and its internal AI tool, and is conducting a security audit with an external independent organization.
