Binance co-founder He Yi said the exchange’s security team detected and blocked 57 cyber threats suspected of being linked to North Korea throughout 2026. While warning that state-backed hacking groups are carrying out unprecedentedly persistent targeted attacks against exchanges and the Web3 ecosystem, she expressed deep regret and reflected on the recent $6.3 billion on-chain breach, saying, “Despite stopping countless attacks, the cost of allowing just one defense failure was unbearably severe.”
According to the specific intrusion techniques He Yi disclosed, the attackers focused on complex social-engineering methods targeting human psychology and development environments rather than exploiting cryptographic weaknesses in systems. Major attack vectors included distributing malware through fake job offers and interviews; infiltrating software supply chains with Trojan software disguised as popular open-source projects and developer utility tools; distributing tampered browser extensions and fake videoconferencing applications designed for phishing; and targeted spear-phishing campaigns intended to steal employee account credentials and install remote access trojans (RATs).
Her remarks illustrate how, as major cryptocurrency exchanges remain persistent targets of hacking groups linked to North Korea’s Reconnaissance General Bureau, a single compromised endpoint used by a developer or operations worker can expose the entire custody and infrastructure environment to critical risk. Emphasizing that “this should never have happened,” He Yi indicated that Binance plans to comprehensively rebuild its internal privilege segregation and Zero Trust security framework from the ground up to address an asymmetric threat environment in which blocking even one breach is more important than successfully defending against dozens of attacks.