North Korean Hackers Spent 5 Months Preparing Binance Hack... Why They Even Staged Fake Interviews [Current Affairs Show]

More than three years' worth of exports stolen in one go
Concerns over use to fund the regime and nuclear development

■ Program: The Asia Business Daily's "So Jongseop's Current Affairs Show"

■ Host: So Jongseop, political specialist

■ Producer: Ma Yena, PD

■ Guest: Lee Hyunwoo, reporter

The international community has been shocked by revelations that a North Korean hacking group breached Binance, the world's largest cryptocurrency exchange, and stole about 18,270 bitcoins. The incident, which came to light late last month, is considered unprecedented not only in the scale of the losses but also in the methods used. The hackers are believed to have spent about five months devising a plan resembling a military operation, then infiltrated Binance's internal network by setting up a fake company and conducting a "job interview" with an employee.

North Korean hackers steal more than three years' worth of exports in one swoop... also use AI

Reuters-Yonhap News

The stolen assets are worth about $1.4 billion at current prices, or approximately KRW 1.87 trillion. In a single hack, the perpetrators obtained well over three times North Korea's annual exports last year, which totaled about $400 million. The U.S. Federal Bureau of Investigation (FBI) and Binance have identified North Korean hackers as responsible for the incident.

In an interview, Binance founder Changpeng Zhao warned, "If they can steal this much bitcoin, hacking ordinary financial institutions would be quite easy for them." The international community is increasingly concerned that North Korea is using cryptocurrency theft as a major source of foreign currency, cashing out the proceeds to fund the development of new weapons.

According to Binance's report on the incident, North Korean hackers first targeted an engineer at Binance who was preparing to change jobs. After learning in advance that the employee was looking for a new job on a recruitment platform, they set up a convincing shell company.

The hacker introduced himself as the company's CEO and interviewed the engineer. During the interview, he assigned the engineer a task, saying he wanted to "check his skills." Malware was hidden in the task file.

The problem was that the engineer installed the task program on a laptop used for work. The malware immediately provided a gateway into Binance's internal IT network. After gaining access, the hackers moved through the network and took control of the computers of employees responsible for cryptocurrency wallet operations, then stole a large amount of coins.

Notably, the North Korean hackers used not only their own technical expertise but also artificial intelligence (AI) programs during the operation. Analysts say the combination of a skilled hacking group and AI technology made it possible to steal an unprecedented amount of cryptocurrency. The incident showed that even a major exchange with extensive defenses cannot feel secure when attackers target people with social engineering tactics, rather than exploiting gaps in security technology, and use AI as well.

More than Tesla's bitcoin holdings... concerns over funds for regime and nuclear development

Reuters-Yonhap News

About 18,270 bitcoins were stolen. At a price of about $78,500 per bitcoin, they are worth $1.4 billion, or approximately KRW 1.87 trillion. That is about 7,000 more bitcoins than the amount held by U.S. electric vehicle maker Tesla.

The impact is even greater when measured against the size of North Korea's economy. North Korea's exports totaled about $400 million last year. The value of the stolen assets exceeds three times that amount. This is why some say that, with normal trade blocked by sanctions against North Korea, hacking has effectively become the country's largest "export industry."

The stolen funds are expected to be laundered and moved through various channels. There are serious concerns that they could then be used to fund the North Korean leadership or the development of new weapons, including nuclear weapons and missiles. North Korean hackers are already notorious internationally, but analysts say the scale of this single incident is extraordinary.

North Korean hackers are reportedly laundering the stolen coins by repeatedly moving them among multiple wallets. The goal is what is known as "cutting the trail": breaking the links between transactions so authorities in various countries cannot trace the funds' origins.

More than 3,000 bitcoin wallets have been used, and the total exceeds 12,000 cryptocurrency wallets when other coins are included. The hackers are evading intelligence agencies' tracking by converting bitcoin into other coins, such as Ethereum, and then immediately exchanging it for yet another coin. North Korea's Lazarus Group is considered the most skilled organization in this field.

Ultimately, North Korea wants dollars, not coins, to use for foreign trade and the smuggling of essential goods. However, cashing out is expected to be difficult. Some observers believe it could take anywhere from several months to several years, while others estimate that only around 10% of the stolen funds can actually be converted into dollars.

One reason is that the "financial backers" who used to buy North Korean cryptocurrency have been cut off one after another. Iran and armed groups in the Middle East had been buying cryptocurrency stolen by North Korea, but they have lost the capacity to do so since the war with the United States. Instead, they are selling off their own coins to buy essential goods.

The large criminal compounds in Cambodia have also effectively disappeared following sweeping crackdowns, dealing another blow. They had laundered North Korean coins and passed them on to legitimate companies or other businesses. Small Chinese exchanges and criminal groups still work with North Korea, but they lack the financial resources to handle such a large sum at once. Analysts say that, with these intermediaries gone, North Korea has had little choice but to launder the funds in conspicuous ways.

The U.S. condemns North Korea, while China says it "cannot confirm"... conflicting calculations

The United States and China have taken sharply different positions on the incident. The United States, led by the FBI, has strongly condemned North Korea, while China has effectively defended it, saying it "could not confirm" the allegations.

Because Binance is commonly perceived as a Chinese company, some have questioned whether China is siding with North Korea despite the damage to a company from its own country. However, Binance is not, strictly speaking, a Chinese company. Its founder, Changpeng Zhao, is of Chinese descent but is a Canadian citizen. The company was strongly associated with China because of its early ties to the Chinese government and the large number of Chinese employees, but Binance now describes itself as a multinational company with no headquarters in any particular country.

China's cryptocurrency regulations are also a factor. China officially bans all cryptocurrency trading within the country. Existing holdings are allowed, but official trading is prohibited, with authorities merely turning a blind eye to over-the-counter transactions between individuals. For this reason, some interpret the Chinese government's position as reflecting difficulty in responding specifically to the FBI's announcement.

Diplomatic calculations are also at play. Since North Korea has actively pursued closer ties with China following the COVID-19 pandemic, Beijing has an incentive to shield Pyongyang. A bigger concern is that, as the issue grows, the involvement of Chinese criminal groups in laundering the funds could come to light. The Cambodian criminal compounds were also linked to Chinese criminal groups, so an escalation could inevitably lead to diplomatic friction not only with the United States but also with Southeast Asian countries. Analysts say this is why China has chosen to avoid commenting as much as possible and to take a position that favors North Korea.

This content was produced with the assistance of AI translation services.