# Lichtenstein Says Binance Hack Tactics Resemble North Korean Methods By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/48688 Published: 2026-11-04T17:59:21.000Z Updated: 2026-11-04T17:59:21.000Z Section: Technology > He described employee phishing as a possible tactic and said the first 48 hours after an attack are critical for tracing stolen funds. Ilya Lichtenstein said tactics in Binance’s Oct. 29 hot-wallet compromise resembled methods associated with North Korean hackers, while describing employee phishing as one possible route for exchange intrusions. Lichtenstein said attackers may try to compromise exchange employees through phishing rather than breach exchange websites directly. That possibility was not confirmed as part of Binance’s incident, and the comparison did not identify who carried out the compromise. He said the first 48 hours after an attack are critical for tracing stolen funds. Artificial intelligence can also facilitate rapid transfers, adding urgency to early tracking efforts. Binance suffered a hot-wallet compromise Oct. 29. President Donald Trump said investigators were examining a possible North Korean link to the hack, leaving attribution unresolved. Trump’s comments on [the investigation into a possible North Korean link]() did not establish North Korea’s involvement. ## Links in this article - [the investigation into a possible North Korean link](https://www.tokenpost.com/news/technology/45137)