North Korea’s Crypto Heists Start on the Open Internet

As cited

Copy frozen at 2026-10-30 22:48 UTC (site build).

threat intel

North Korea’s Crypto Heists Start on the Open Internet

North Korean operators conduct cryptocurrency heists by first compromising developers and engineers through social engineering on the open internet, including fake job interviews and malicious domains registered days before attacks. The February 2025 Bybit theft ($1.5 billion) and April 2025 Binance incident ($6.3 billion) followed this pattern: operators gained footholds through developer deception, then leveraged those positions to compromise wallet infrastructure and steal assets on-chain. As of October 30, 2026, at least 64 active malicious domains mimicking Binance remain live, with 206 such domains tracked at maximum risk.

Why it matters: Cryptocurrency exchanges, financial institutions, and development teams must treat engineer and DevOps hiring as a critical attack surface; North Korean operators actively impersonate legitimate companies and run sustained social engineering campaigns targeting these roles, making background verification and technical interview protocols essential for defense.

Source published

2026-10-30 21:19 UTC

First seen by Cybersecurity Tracker

2026-10-30 22:00 UTC