Suspected North Korean hackers have escalated their crypto infiltration campaign, with new details linking a $1.46 million transfer through Solana-based DeFi to a broader playbook that preceded the $6.3 billion Binance heist.
According to on-chain tracking, the funds moved through Jupiter Lend and Circle’s cross-chain bridge from a Solana wallet flagged by the FBI. Analysts say the transfer passed through 35 intermediary wallets. Jupiter Lend’s COO confirmed the funds were not frozen but remain fully traceable, a detail that underscores both the sophistication of the attackers and the transparency of blockchain forensics.
Chainalysis has now attributed more than $14.3 million in crypto losses over the past 18 months to the same North Korean fake-interview scheme. Dozens of fake job interviews led to wallet compromises affecting individual holders, private wallets, protocols and DAOs. Individual losses ranged from tens of thousands of dollars to millions. Tom McLouth, senior intelligence analyst at Chainalysis, described the attacks as practice for the Binance breach: “That’s how you end up with the biggest heist in history.”
Binance traced its own breach to a job interview invitation sent to an engineer in September. The engineer downloaded a malicious interview assignment after two rounds with a fake company. Chainalysis calls this method “contagious interviews,” aimed at staff with privileged access. The malware searches for wallet mnemonic phrases, KeePass and 1Password stores, and cryptographic keys. Some victims reported seed phrases were never on infected devices, suggesting stolen cloud logins or browser sessions may also be in play.
Microsoft has tracked the Contagious Interview campaign since at least December 2022. Separately, Chainalysis reports a fivefold increase in blockchain-enabled cyberattacks over the past 12 months. North Korean actors began using “Etherhiding” in early 2025, embedding command-and-control instructions in blockchain records. One setup divided instructions between TRON and Aptos, with the payload hosted on BSC and Aptos serving as a fallback. A newer “null receiver” approach places instructions inside a specially crafted address.
The FBI, Japan’s National Police Agency, and agencies in Australia and Germany have blamed a North Korean crew called WaterPlum for a roughly $10.71 million heist affecting about 7,000 crypto accounts. The FBI attributed the Binance hack to the group TraderTraitor; Pyongyang has denied involvement. Chainalysis expects the stolen funds to remain on the move as investigators and exchanges track the flows.
