From a PDF to $6.3 Billion: How North Korean Hackers Infiltrated the Crypto World

North Korean hackers breached Binance hot wallets across nine chains on October 30, 2026, draining over $6.26 billion in a single night, with the FBI attributing the attack to the Lazarus Group and President Trump saying the US would negotiate with Pyongyang if its involvement is confirmed. The breach caps a decade-long campaign: TechFlow tallies 37 crypto thefts tied to North Korea since 2017 totaling roughly $11.82 billion, starting with a $7 million hack of South Korean exchange Bithumb and escalating through the $620 million Ronin Bridge exploit (via a fake job-offer PDF and an unrevoked Axie DAO signing permission), the $100 million Harmony Horizon Bridge theft, over $238 million across Atomic Wallet, Alphapo, CoinsPaid and Stake.com in 2023, $235 million from India's WazirX in July 2024, and a $1.5 billion Bybit cold-wallet heist in February 2025 executed by compromising multisig provider Safe{Wallet}. Beyond direct attacks, North Korean IT workers have infiltrated the industry itself—CoinDesk identified over 24 crypto firms, including Cosmos Hub, Injective, Fantom, Sushi, Yearn Finance and Truflation, that unknowingly hired them, with the Munchables developer "Werewolves0943" stealing 17,400 ETH (~$62 million) on Blast before returning it, and UN estimates put the regime's IT-worker revenue at up to $600 million annually. CrowdStrike reports North Korean IT workers penetrated more than 320 companies in 12 months, up roughly 220% year-over-year, using fake identities, US-based laptop farms, and generative AI to pass video interviews. The escalation from $600 million to $6.26 billion in single-incident losses shows social engineering and supply-chain compromise now defeat even cold-wallet and multisig defenses, making personnel vetting and third