Lichtenstein says the Binance hot-wallet hack echoed North Korean tactics

The Binance hot-wallet hack on October 29, 2026, used tactics resembling those associated with North Korean hackers, Ilya Lichtenstein said. His comparison comes alongside Binance’s account of fake recruitment, malicious downloads and compromised internal AI tools in an attack involving $6.34 billion in assets.

Donald Trump, the President, stated that investigators were looking into a possible North Korean connection. That statement and Lichtenstein’s assessment do not establish North Korea’s involvement. CNBC reported that while Binance co-CEO Richard Teng stopped short of blaming North Korea directly, he confirmed the FBI had tied the breach to North Korean hackers associated with the TraderTraitor group.

Lichtenstein described employee phishing as a possible way into cryptocurrency exchanges, rather than attacking their websites directly. His suggestion was not confirmation of the route used in this incident.

Binance’s hot-wallet hack followed months of infiltration

Binance’s account describes a staged intrusion involving engineers and wallet authorization systems. Co-CEO Richard Teng said the attackers spent months gaining access, rejecting the idea that one employee’s laptop represented a single point of failure.

A Binance security report traced preparations to June, when an engineer downloaded a tampered Homebrew installation while seeking an AI coding tool. Binance detected suspicious activity, replaced the device and rotated credentials, but said the engineer’s role and colleagues had already been exposed.

In September, attackers posing as recruiters put another engineer through interviews and a coding exercise containing hidden malware, Teng said. They then moved through internal AI tools to reach the system authorizing wallet transactions.

Teng said Binance had replenished 98% of affected assets and was purchasing the remaining, less-liquid assets. Customers withdrew $3.6 billion when the exchange reopened on November 1. Binance pledged to cover customer losses and rebuilt the affected wallet system and internal AI tool.

Lichtenstein emphasized the first 48 hours after an attack as critical for tracing stolen funds. Artificial intelligence can accelerate transfers after a theft, adding urgency to early tracking.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.