Binance Founder Changpeng Zhao North Korea’s $1.34B Crypto Theft Tactics

What Happened

Binance co-founder Changpeng Zhao (CZ) has warned that North Korean hackers are using increasingly advanced methods to infiltrate cryptocurrency companies. In a recent X post, CZ explained:

“They exploit trust, creativity, and patience to breach platforms and steal user funds.”

According to Chainalysis, North Korean hackers stole around $1.34 billion in crypto in 2024, with both the U.S. and U.N. confirming that the stolen money is being used to help finance North Korea’s weapons program.

“Hackers often apply for developer, finance, or security positions. Once hired, they have insider access — a long-term foot in the door for future attacks.”

This strategy allows them to embed themselves in organizations and quietly prepare for larger hacks.

Customer Support Exploits in Crypto Exchanges

Hackers also pretend to be regular users seeking help. They send links that look legitimate but redirect to infected pages.

Some hackers bypass technical firewalls altogether by bribing employees or targeting third-party vendors.

“In India, hackers breached a major outsourced service provider. Critical data from a U.S. exchange leaked — users lost over $400 million.”

Social Engineering Attacks: From Screen Sharing to One-Click Hacks

Crypto investor Anndy Lian added his warning on X:

“Hackers don’t always need files for you to click. Just sharing your screen can give them the access they need.”

CZ agreed, adding that even one-click hacks — like the rumored Jeff Bezos phone breach — prove how dangerous a single link can be.

Market Context

The post Binance Founder Changpeng Zhao North Korea’s $1.34B Crypto Theft Tactics appeared first on Coinpedia Fintech News

Job Applications as a Trojan Horse in Crypto Security Breaches

Why It Matters

This turns routine recruitment tasks into high-risk entry points.

Details

One of the most common tactics involves posing as job candidates. CZ wrote:

Fake Employers and Malware Hidden in Coding Tests

Another tactic is impersonating employers. During fake interviews on Zoom, attackers create staged technical issues and trick employees into downloading malicious “updates.”

CZ explained:

“In some cases, they send ‘sample code’ for a coding test. That code is secretly malware.”

“Once an employee clicks, attackers can steal data or even gain direct access to exchange systems,” CZ warned.

Insider Bribery and Outsourced Service Vulnerabilities

CZ pointed to a recent case: