Chainalysis

🚨 PSA: We continue to receive reports of third parties impersonating Chainalysis on various platforms. These scammers often use similar tactics and offer everything from help recovering lost funds to fake jobs usually in exchange for information or a fee. Our team works hard to detect and take these scams and impersonations down as soon as they are discovered, however if you get any of these messages, or believe you may be the victim of a scam, contact local law enforcement. You can also let us know via spoof@chainalysis.com so we can continue to track and manage these scams proactively.

𝐖𝐞 𝐰𝐢𝐥𝐥 𝐍𝐄𝐕𝐄𝐑 𝐫𝐞𝐚𝐜𝐡 𝐨𝐮𝐭 𝐭𝐨 𝐲𝐨𝐮 𝐅𝐈𝐑𝐒𝐓. We also won’t:
💰Ask you for funds
💸Promise you recovery of lost funds from scams or hacks
📋Offer you a job in exchange for any type of “fee”
💻Ask you to provide your information via a link on text, messaging services or unverified email
📵Send you unsolicited phone calls, emails, WhatsApp, Signal, Telegram or text/SMS
🔗Reminder: Chainalysis primarily provides its products and services to public and private sector businesses, and does not engage in investigation assistance for individual victims

We have more tips you can use to verify if the contact is legitimate on our website: chainalysis.com/scams

The $6.4B Binance theft by North Korean actors began with a fake job interview, per Binance's initial findings.

We have attributed more than $14.3M in losses over the past 18 months to similar DPRK-linked faked interview and malware schemes.

These schemes have spanned a wide range of targets, from individual crypto holders and private wallets to organizations, protocols, and DAOs.

Our analysis suggests these earlier compromises allowed North Korean actors to refine their methods on small targets before deploying them against higher-value targets.

Per Binance, attackers spent weeks building trust with an employee, first approaching the employee through a legitimate job platform with a fake job opportunity.

After two rounds of interviews with a fictitious company, the Binance employee was asked to download an interview assignment that contained malicious code.

From there, they deployed malware and exploited access to an internal AI tool to move deeper into Binance's system.

We have observed multiple similar cases in which victims had wallet private keys stolen from cloud storage following a malicious interview.

Our research also indicates that North Korean actors have used fake employment schemes for other cyber attacks.

For instance, they have used such schemes to conceal malware in public blockchains. We’ve found a fivefold surge in these blockchain-assisted cyberattacks over the past year

The same actors can exploit recruitment platforms, compromise corporate infrastructure, infiltrate legitimate businesses and use crypto to move the resulting proceeds.

Chainalysis closely monitors how DPRK actors use crypto to generate revenue, move and consolidate funds, and launder illicit proceeds.

Combined with traditional cybersecurity measures and threat intelligence, blockchain analysis can help organizations and investigators identify and freeze stolen funds.

It can also map DPRK's expanding financial networks and uncover procurement and payment patterns that can support sanctions investigations and enforcement.

The Binance investigation remains ongoing and we expect stolen funds to continue moving in the coming days.

North Korean hackers stole at least $2.02B in crypto in all of 2025, bringing their all-time total to at least $6.75B.

The Binance hack alone moved ~$6.4B, 95% of that all-time total.

The DPRK continues to undertake significantly higher-value attacks than other threat actors reinforcing that when North Korean hackers strike, they target large services and aim for maximum impact.

Early this morning Mercado Bitcoin, Brazil’s largest crypto exchange, suffered a security incident that resulted in ~$49 million in stolen funds.

In the early hours of November 2 an attacker began moving assets held across 17 blockchains, working in waves to drain the estimated $49 million in various cryptocurrencies.

The first few hours of any hack are the most important for investigators. In that window of opportunity they can help freeze some assets, like centrally-issued stablecoins, before the attackers are able to convert them into harder-to-disrupt cryptocurrencies, like BTC and ETH.

We immediately mobilised our global team of investigators to lead the blockchain intelligence response, working closely with Mercado Bitcoin, law enforcement, and industry partners to help freeze nearly $10 million in stolen funds.

At 2:30 am ET a Mercado Bitcoin director phoned our in-country solutions expert with the news: the exchange had been hacked.

Within 30 minutes we made contact with law enforcement to relay freezable addresses.

By the time morning had arrived we had helped lock down stolen stablecoins. Our work led to millions of dollars in freezes in the hours that followed.

Over the course of this hack we communicated directly with Paxos, Anchorage Digital, Ripple, Circle, and Tether, working together with law enforcement to shut down stolen stablecoins.

Our investigators identified stolen funds held in USDT and rapidly traced them to addresses where the assets could potentially be frozen.

Using our established relationships with Tether and law enforcement, we escalated the relevant addresses and supporting intelligence, enabling Tether to take action and freeze over $9 million in stolen funds.

We’re continuing to trace the remaining funds, monitor their movement, and identify further opportunities for intervention.

Our investigators are tracking the Mercado Bitcoin security incident and are working with industry partners to identify, freeze, and disrupt impacted funds.