Chainalysis ties $14.3M in earlier thefts to the trap that hit Binance

Chainalysis has attributed more than $14.3 million in crypto losses over the past 18 months to the North Korean fake interview playbook that later targeted Binance.

The blockchain analytics firm regards those smaller heists as practice for the $6.3 billion theft.

Dozens of fake job interviews led to wallet compromises

The losses were from DPRK-linked fake interviews and malware schemes, with targets ranging from individual crypto holders and private wallets to protocols and DAOs.

“We’ve identified dozens of other job interview compromises that have led to wallet compromises” at the individual level, said Tom McLouth, a senior intelligence analyst at Chainalysis. Individual losses ranged from tens of thousands of dollars to millions.

North Korean crews were “perfecting and evolving their methodology” in those attacks, he said. “That’s how you end up with the biggest heist in history,” McLouth said.

The Binance attack could be the climax of months or even years of practice, Chainalysis says. Cryptopolitan reported that Binance traced its own breach to a job interview invitation sent to an engineer in September.

The engineer downloaded an interview assignment that had been seeded with malicious code after two rounds with a fake company. Chainalysis Senior Manager of Global Services Alec Zebrick calls this “contagious interviews” and they are aimed at staff with privileged access so that their credentials can be turned against the employer.

Chainalysis also highlighted instances of private keys being stolen from cloud storage after a malicious interview. Some victims said their seed phrases were never on the infected device, which Chainalysis says may signal stolen cloud logins or browser sessions.

In March, Microsoft documented that its Defender Experts team has tracked a Contagious Interview campaign that has been active since at least December 2022.

In this campaign, fake recruiters from crypto trading firms or AI companies get applicants to run malicious code packages.

Inside, the malware seeks out wallet mnemonic phrases, KeePass and 1Password stores, and cryptographic keys, Microsoft said.

Blockchain Dead Drops surged fivefold in a year

Chainalysis also reports that blockchain-enabled cyberattacks have increased fivefold in the past 12 months. Chainalysis calls it Blockchain Dead Drops and the uptick has been attributed to nation-state actors and the potential use of open-weight AI models.

North Korean actors began using the technique, called “Etherhiding,” in early 2025. It ties machines infected through fake job interviews to the attackers’ command-and-control servers, as a blockchain record is harder for police to seize than central hosting.

One DPRK setup divided instructions between TRON and Aptos. Both the chains have pointers to the payload hosted on BSC and infected devices are redirected to the payload.

Aptos is the fallback if TRON fails.

The newer “null receiver” approach implants the instruction inside a specially crafted address. The address is uncontrolled and is not designed to hold crypto.

The address is interpreted as a command by infected machines.

In September, the FBI, Japan’s National Police Agency and agencies in Australia and Germany publicly blamed a North Korean crew called WaterPlum for a ~$10.71 million crypto heist.

WaterPlum is also called the “Contagious Interview.” Its operation affected sensitive data on about 7,000 crypto accounts.

The FBI attributed the Binance heist to the North Korean group TraderTraitor, but Pyongyang denied any involvement. Chainalysis expects the stolen funds to remain on the move over the coming days.