North Korean Hackers: How They Steal Crypto and How Traders Can Protect Themselves

North Korean Hackers: How They Steal Crypto and How Traders Can Protect Themselves

North Korean hacking groups have for years been considered among the most dangerous for the crypto industry. Their methods change, but the attack almost always starts not with the exchange's code but with a person.

Below, we look at typical schemes, the recent Binance hack and simple steps that reduce the risk for an ordinary trader.

Who Lazarus and TraderTraitor are

Lazarus is an umbrella name for hacking groups that the US government and analytics firms link to North Korea. TraderTraitor is one of its branches, specializing in crypto companies and their employees.

The goal of such groups is financial. The stolen crypto then goes through a laundering chain.

How North Korean hackers break into exchanges

Fake job offers and test assignments

Attackers message developers and engineers posing as recruiters from well-known companies. After a couple of interviews, the candidate is sent a "test assignment", a project with malicious code hidden inside.

Malicious files and apps

These can be documents, "trading programs", plugins or development packages. Running a single such file opens access to the device.

Compromised work devices

An employee's infected laptop is a convenient entry point. From it, attackers can steal sessions, passwords and access keys to the company's internal systems.

Social engineering

Attackers build trust over a long time: they chat, hold calls and pose as partners or colleagues. From what we see, the victim often performs the required action themselves without suspecting a thing.

The Binance hack via an engineer's laptop: what we know

According to reports on the October 29 attack on Binance, the attackers got into the systems through a DevOps engineer's laptop. In total, about 6.3 billion dollars was stolen.

Identifying the culprits is the investigators' job, and we draw no conclusions here beyond the facts. But the vector itself matches what analysts have long described for groups like Lazarus.

The positive side of the story is the speed of the response. About 3 billion was frozen with the help of industry partners, and Binance promised to cover losses from its reserves.

How stolen crypto is laundered

In broad terms, the schemes are similar. The coins are split across many addresses, moved through cross-chain bridges, swapped on decentralized exchanges and run through mixers.

Stablecoins are the weak link in such a chain. The issuer can freeze them, so attackers try to swap them for non-freezable assets as quickly as possible.

Why this is dangerous for an ordinary trader

How to protect yourself: a trader's checklist

• keep a separate device for exchanges and wallets and run nothing else on it
• do not complete "test assignments" or open projects from unknown recruiters on your work computer
• use hardware 2FA keys instead of SMS and, where possible, instead of authenticator apps
• enable a withdrawal address whitelist on every exchange
• issue API keys without withdrawal rights and with IP restrictions
• keep your main coin holdings on a hardware wallet, and only working capital on exchanges

A hypothetical example

The numbers are hypothetical. A trader holds 40,000 dollars: 25,000 on a hardware wallet and 5,000 on each of three exchanges with address whitelists.

If an attacker gains access to the laptop, they cannot withdraw the 15,000 from the exchanges to their own address: the whitelist only allows transfers to the trader's addresses. The hardware wallet will not release a single coin without physical confirmation either.

In our view, simple barriers like these are exactly what separates an unpleasant incident from a total loss of capital. We believe they are worth setting up in one evening, not after the first suspicious email.

Our tools

Working capital spread across several exchanges is easier to keep in play when prices on every venue are visible at once. Our arbitrage screener keeps dozens of venues in one window, refreshes quotes every second and shows each gap together with the volume actually behind it. The spread calculator helps you check what survives fees, network costs and slippage at your size. The bot is fully manual. It never connects to your exchange API keys.

To test the tools on a live market, ArbitrageScanner offers one day of free access to the whole ecosystem.

FAQ (Frequently Asked Questions)

1. Who are Lazarus?

It is an umbrella name for hacking groups that the US government and analytics firms link to North Korea. Their main goal is stealing crypto.

2. How do North Korean hackers break into crypto exchanges?

Most often through people: fake job offers, test assignments with malicious code, infected employee work devices and long-running social engineering.

3. How was Binance hacked in October 2026?

According to reports, the attackers got into the systems through a DevOps engineer's laptop. About 6.3 billion dollars was stolen, and about 3 billion was frozen.

4. Is it dangerous to complete a recruiter's test assignment?

Yes, if you run someone else's code on your work device. Test assignments are one of the favorite ways to deliver malware.

5. How to protect crypto from hackers?

A separate device for exchanges, hardware 2FA keys, a withdrawal address whitelist, API keys without withdrawal rights and your main holdings on a hardware wallet.

6. How do hackers launder stolen crypto?

In broad terms, they split it across many addresses, move it through cross-chain bridges, swap it on DEXs and run it through mixers.

Conclusion

North Korean groups like Lazarus primarily target people: through fake job offers, test assignments, malicious files and infected work devices. The Binance hack via an engineer's laptop shows how dangerous this vector is even for the largest companies.

A few simple barriers are enough for a trader: a separate device, hardware 2FA keys, address whitelists and API keys without withdrawal rights. They stop an attacker from withdrawing funds even if the laptop is already infected.

IMPORTANT! We are software developers. We do not give recommendations or promises of earnings and we do not advise you to invest your money anywhere. Our software is fully manual, all your money stays under your own control. We show examples of how our clients have earned on arbitrage in the past, but we do not advise repeating those actions one to one. Your earnings depend solely on your own actions and on market factors.