A North Korean intelligence officer in China believes his own country carried out the record $6.3 billion Binance hack, which contradicts Kim Yo Jong’s repeated public denials of Pyongyang’s role in the November 2026 cryptocurrency heist.
The officer works for the Reconnaissance and Intelligence General Bureau in China’s Liaoning province, a Daily NK source in China said on Friday. He recently raised the attack on the world’s largest crypto exchange in conversation. “Judging by the route and the method, this was a job carried out by our side,” the officer said, according to the source.
The bureau succeeded the Reconnaissance General Bureau as North Korea’s main military intelligence agency. It oversees the state hacking units behind many of the country’s cyberattacks and cryptocurrency thefts. In July, Daily NK reported that veterans of one of its cyber units had hacked North Korea’s own state banks.
The officer called one tactic “a common method” for these units. Hackers approach IT industry workers with job offers, then plant malware on their devices. Groups under the bureau have relied on this textbook approach for years.
Binance’s own investigation points in the same direction as the officer’s assessment. In a report released on Nov. 3, the exchange said the attackers used social engineering built around fake job interviews. Social engineering manipulates people into handing over access instead of breaking through technical defenses.
According to the report, the hackers began targeting Binance employees in June. One developer downloaded tampered software that the attackers had prepared in advance. Another sat for a fake job interview and installed malware disguised as an interview assignment. The FBI has attributed the theft to TraderTraitor, a North Korea-linked group also blamed for the 2025 Bybit hack.
Binance hack follows a familiar playbook
South Korean security experts say the methods behind the Binance hack match a well-worn North Korean pattern. North Korean hacking groups have used these same techniques again and again.
“Approaching company employees by impersonating recruiters or proposing video interviews is a long-standing technique of North Korean hacking groups,” said Moon Jong-hyun. Moon directs the Genians Security Center, the threat research arm of South Korean cybersecurity firm Genians. The center regularly tracks North Korean hacking campaigns and the groups behind them.
“These groups keep using attacks that exploit individual psychology and relationships of trust,” Moon told Daily NK. “For example, they get people to install malware through programs supposedly needed for an interview or for work.”
“North Korean hackers are distinctive because they don’t only target weaknesses in the system itself,” he said. “They first go after the people who have permission to access it. The same approach appeared in the Binance case, which closely resembles the methods of existing North Korean hacking groups.”
The intelligence officer said that “70% to 80% of the IT workforce operating overseas is in China.” He suggested the group behind the hack is most likely based in China as well. However, he insisted that the organization he manages did not carry out the operation. In his view, another unit under the bureau appears responsible.
He said he does not know which part of the bureau controls that unit or where it operates. Even units under the same bureau do not share details about their activities, personnel or bases. That practice has long been reported among North Korean IT workers in China.
His account suggests the bureau runs its overseas hacking teams as tightly compartmentalized cells. Information between teams is strictly blocked, so the exposure of one team does not compromise the others.
Notably, the officer reached his conclusion from the attack route and techniques alone. He did so even as North Korean authorities officially deny any connection to the hack.
Kim Yo Jong, a department director of the Workers’ Party of Korea Central Committee, is the sister of leader Kim Jong Un. She issued statements on Nov. 2 and Nov. 4 lashing out at the United States for naming North Korea as the culprit. She called the accusation a “preposterous rumor” and a “political provocation” rooted in Washington’s hostile policy toward Pyongyang.
The officer was not directly involved in the attack and has not identified the unit behind it. His remarks therefore cannot serve as proof of North Korean responsibility. Still, an official who knows this work from the inside regards the hack as his country’s operation. That view stands in direct conflict with Pyongyang’s official position.
“The attack methods confirmed in the Binance case resemble those North Korean hacking groups have repeatedly used,” Moon said. “So it is reasonable to view this as North Korea’s work. Because these groups’ techniques follow certain patterns, other IT organizations within North Korea could also easily recognize who was behind it.”
Moon said companies cannot defend against these intrusions with technology alone. “North Korean hacking groups keep attempting attacks that exploit not only system vulnerabilities but also individual psychology,” he said. “To respond effectively, organizations need to build security systems and also train individuals on the major hacking techniques.”
This article was originally written in Korean and translated with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
Daily NK operates networks of sources inside North Korea who document events in real-time and transmit information through secure channels. Unlike reporting based on state media, satellite imagery, or defector accounts from years past, our journalism comes directly from people currently living under the regime. We verify reports through multiple independent sources and cross-reference details before publication.
Our sources remain anonymous because contact with foreign media is treated as a capital offense in North Korea — discovery means imprisonment or execution. This network-based approach allows Daily NK to report on developments other outlets cannot access: market trends, policy implementation, public sentiment, and daily realities that never appear in official narratives.
Maintaining these secure communication channels and protecting source identities requires specialized protocols and constant vigilance. Daily NK serves as a bridge between North Koreans and the outside world, documenting what’s happening inside one of the world’s most closed societies.
November 9, 2026 at 08:26PM
by DailyNK(North Korean Media)