What happened
Decrypt published a technical breakdown on Tuesday identifying five infiltration tactics that North Korean threat actors have used to get inside crypto companies, with Binance named among the victims. The reporting consolidates what incident responders and threat intel teams have been documenting through the year: DPRK operators are no longer just phishing executives. They're applying for jobs with AI-generated faces and resumes, planting malicious packages in npm and PyPI repositories, running long-game social engineering campaigns on Telegram and Discord, compromising third-party contractors and auditors, and pivoting from a single developer laptop into production signing keys.
The Binance incident, per Decrypt, fits that composite pattern rather than a single zero-day. Attribution tracks back to clusters previously identified by the FBI and private researchers as Lazarus Group and APT38, both operating under the Reconnaissance General Bureau.
Why it matters
The playbook described isn't theoretical and it isn't new. It's the operational model that drained Axie Infinity's Ronin bridge for $625M in 2022, hit Harmony's Horizon for $100M the same year, and more recently emptied WazirX for $235M. What's shifted is the velocity and the vector mix.
Deepfake video interviews that pass a two-round technical screen are now cheap enough to run at scale, and supply-chain poisoning of widely used dev dependencies means one compromised maintainer account can reach every exchange that pulls the package. If Binance - with arguably the deepest security budget in the industry - sat inside this attack surface, every tier-two venue should assume they already have resumes from DPRK operators in their recruiting pipeline.