The biggest crypto heist in history didn't start with a genius breaking through a firewall. It started with a job interview. The FBI says North Korea stole $6.3 billion from the crypto exchange Binance. It started by contacting an employee about a job, then getting him to download an assignment that hid malicious code. North Korea called the claim absurd.
Binance said the attackers reached the employee through a legitimate job-hunting platform. During a second-round interview with a fake company, he was told to download the assignment onto his work computer. That file carried the code. This is what security people call social engineering: tricking a human into opening the door rather than forcing the lock. North Korea leans on it heavily. The regime is now responsible for 89% of crypto hacking losses this year, up from 15% in 2021, according to one analytics firm. It uses the proceeds to fund weapons programs.
Why the money is gone
More than half the stolen funds can't be frozen. The regime typically moves fast, swapping stolen assets into bitcoin and cashing them out through brokers over months. In an earlier hack, it took about 10 days to convert the assets and several more months to cash out through suspected trading services. The scale is new. The method is old. It's aimed at ordinary people every day. A message that looks legitimate, a sense of opportunity, and a file or link to open.
The target here was a crypto exchange. The technique works on anyone with an inbox.
Our read
This is a Consumer Protection story, module M11. Strip away the billions and the geopolitics and you're left with a plain truth: the most expensive hacks start with a person clicking something. That's not a crypto problem. It's the same door into your email, your bank and your retirement account. The scam aimed at you won't be a fake job at a crypto exchange. It'll be a text about a package, a call that says it's your bank's fraud department, or a login page that looks exactly right.
Here's the fifteen-minute defense this week, and it's the same advice whether or not you own any crypto. First, slow down on anything that creates urgency or opportunity, a job offer, a prize, a fraud alert, a deadline. Urgency is the tell. Second, never download a file or click a login link that arrives in a message. Go to the site yourself by typing the address or using your saved bookmark. Third, turn on two-step verification everywhere that holds money, so a stolen password alone isn't enough. If you do own crypto, keep the bulk in a wallet you control, not just on an exchange. Stolen crypto usually can't be clawed back the way bank fraud often can. We don't recommend crypto holdings in our model portfolios, and this is part of why. If you're ever unsure whether a message about your accounts is real, the safest move is to not click and call us or the institution directly.