Bitfinex hacker says North Korean tactics used in $6.3bn Binance heist

Ilya Lichtenstein told CNN that attackers likely targeted employees with malware instead of breaching exchange systems directly during the record-breaking theft.

By Divyansh Mishra, YourKhabri DeskNov 4, 2026, 04:30 AM UTC1 min readBinanceNorth KoreaCybersecurityLazarus Group

Photo: belgium24.eu, CC BY 2.0, via Wikimedia Commons

Key takeaways

1Ilya Lichtenstein said the Binance hack targeted human weak links rather than software
2The Binance heist is the largest in crypto history, with $6.3bn stolen
3Investigators have successfully frozen or seized $2.85bn of the stolen assets

Ilya Lichtenstein, the hacker behind the 2016 Bitfinex breach, told CNN on 1 November that the recent $6.3 billion theft from Binance carries the hallmarks of North Korean cyber tactics. Lichtenstein said the attackers likely targeted individual employees through phishing or malware rather than attempting to bypass the exchange's core security. He described the first 48 hours after such a breach as the most critical period for investigators to trace and recover stolen digital assets.

According to Wu Blockchain, which cited the interview, Lichtenstein said hackers now use artificial intelligence agents to speed up the movement of funds between wallets. The permanent nature of blockchain records ensures that transactions remain traceable for years. Earlier reporting by YourKhabri on 3 November confirmed that Binance staff were targeted through fraudulent job interviews, a method consistent with Lichtenstein's assessment of targeting human weak links.

Lichtenstein stole approximately 120,000 BTC from Bitfinex in 2016 before pleading guilty to money laundering conspiracy in 2023. He was released from prison in January 2026 after serving part of a five-year sentence and now says he works as a white-hat hacker. The Binance breach is the largest in the history of the industry, with YourKhabri data showing that $2.85 billion of the stolen funds has been frozen or seized so far.

The use of thousands of wallets and automated transfers suggests a sophisticated laundering operation that investigators are still working to map. YourKhabri reported on 2 November that North Korean actors have opened roughly 12,000 wallets to move the loot, averaging one new address every 25 seconds. Traders and security analysts will monitor whether the remaining $3.5 billion in stolen funds can be successfully laundered or if further seizures by authorities will limit the impact of the heist.

Also reported by

Reported and edited by the YourKhabri desk under our editorial policy. Nothing here is investment advice.