Polylog
← Trends

State Hackers Target Crypto Through Developer Tooling

North Korean and other state-linked groups will keep breaching crypto exchanges and custodians by combining social engineering of developers (fake recruiters, job interviews) with poisoned developer and AI-tooling packages. That produces recurring breaches in the billions, freezes and interceptions that depend on cooperation across exchanges, and growing pressure on exchanges to adopt hardened developer environments and tighter rules for using third-party code.

weakening · confidence 34 · Emerging (watchlist) · tracking since November 9, 2026 · updated November 12, 2026

Sign in to get threshold and movement alerts for this trend.

Score history

Daily conviction score, 0 to 100. Higher means the thesis is more strongly corroborated.

Nov 11 · 36Nov 12 · 34

Now 34 · -2 since Nov 11 · ranged 34 to 36

Showing the last few days. Unlock full score history.

Why the conviction moved

  • Nov 9
    Strengthened

    Binance traced a $6.34 billion breach to a fake job interview and a tampered AI coding tool package. About $2.85 billion had been frozen or intercepted by November 3, and reports say the FBI tied the intrusion to the North Korean group TraderTraitor.

Source trail

  • Supporting · November 9, 2026

    Binance Traces $6.34 Billion Breach to a Fake Job Interview and a Tampered AI Coding Tool Package

    Binance traced a $6.34 billion breach to a fake job interview and a tampered AI coding tool package. About $2.85 billion had been frozen or intercepted by November 3, and reports say the FBI tied the intrusion to the North Korean group TraderTraitor.

    AI Post (Telegram)

Unlock full source trail, score history, and daily updates.

Unlock Trends

Townsquare

Argue the thesis in Townsquare.