North Korean Hackers Steal Record $6.3 Billion from Binance in 20 Minutes
North Korean state-sponsored hackers stole $6.3 billion from Binance in 20 minutes using AI deepfakes and advanced social engineering, marking the largest crypto heist in history.
A sophisticated social engineering campaign combined with a zero-day exploit has resulted in what is considered the largest cryptocurrency heist in history. Hackers backed by North Korea stole $6.3 billion from the world's largest cryptocurrency exchange, Binance, within just 20 minutes, draining funds at a staggering rate of roughly $300 million per minute.
The Anatomy of a Multi-Stage Cyber Attack
According to a detailed technical report published by Binance, the operation began when a company engineer searched for the popular macOS package manager Homebrew on Google. North Korean threat actors deployed a targeted, sponsored search ad that led to a malicious clone containing a backdoor. This malware allowed the attackers to fully map Binance's internal network, permission hierarchy, and digital wallets. Although security teams detected the breach and replaced the compromised machine, critical internal reconnaissance had already been gathered.
In the second phase, the attackers executed a personalized psychological trap targeting another key engineer at the firm. Posing through fake LinkedIn profiles, they offered a dream job at a leading artificial intelligence company. To dispel any suspicion, the attackers conducted video job interviews using real-time deepfake AI technology to impersonate a human resources manager and a CEO. Once trust was established, they persuaded the target to switch to an encrypted messaging app and download a professional testing environment onto their corporate laptop. The moment the malicious payload was executed, the attack systems connected directly to the previously mapped wallets, draining billions of dollars in under 20 minutes.
Economic Scale and State-Sponsored Cyber Operations
Following the breach, Binance managed to freeze approximately half of the stolen funds and compensated users from its internal emergency reserve, ensuring that over 90% of customer assets were recovered, while the company's chief financial officer stepped down. The FBI and international investigators officially attributed the massive cyberattack to North Korea.
The scale of the operation is immense for Pyongyang, whose estimated 2025 GDP stood at approximately $26.6 billion, with an average annual income of $1,000 to $1,300 per capita. A single $6.3 billion heist equates to nearly a quarter of North Korea's entire annual GDP, providing unprecedented capital inflows directed largely toward funding the regime's nuclear and military programs.
This attack is part of a broader, state-sponsored strategy that accelerated following international sanctions imposed after the 2014 Sony Pictures hack. Cut off from the global banking system, the state-backed Lazarus Group turned to cryptocurrency operations, scaling their crypto thefts from $2 billion in 2025 to over $7 billion in 2026. The case underscores that despite advanced technological defenses, human error and sophisticated social engineering remain the most vulnerable links in modern cybersecurity.
