Two leading blockchain‑analytics firms have pointed with "high confidence" to a North Korean state‑backed hacking unit as the most probable culprits behind the massive theft from Binance, the world’s largest cryptocurrency exchange. The $6.3 billion breach, described as the biggest crypto heist on record, has reignited concerns about the reach of North Korea’s cyber‑crime operations.
Who is blamed?
The group identified is the Lazarus Group – also known by the moniker TraderTraitor – which is widely recognized as a North Korean hacking outfit. Both TRM Labs and Chainalysis, two major blockchain‑analytics firms, said their investigations converged on Lazarus with "high confidence". The attribution is based on transaction patterns and the way the attackers accessed Binance’s hot‑wallet signing system, a method not previously observed, according to Chainalysis.
How the hack unfolded
According to Binance’s co‑CEO Richard Teng, the breach began when an engineer’s laptop was compromised, allowing unauthorised withdrawals. Further investigation revealed additional points of breach, suggesting the attackers had gained broader access to the exchange’s hot‑wallet infrastructure. The attackers allegedly used a special authorisation to convert the hot wallet into an automated fund‑moving conduit, directing assets to external addresses.
Recovery efforts
Binance reported that roughly 80 % of the stolen assets have been secured, leaving a substantial portion still unaccounted for. The exchange has been working with law‑enforcement agencies and blockchain‑forensics teams to trace and recover the remaining funds.
North Korea’s cyber‑crime portfolio
The Binance incident follows a pattern of high‑profile cyber‑thefts linked to North Korea. In 2022, the country was accused of stealing $620 million in cryptocurrency. The FBI previously attributed a $1.5 billion theft on the Bybit exchange to North Korean actors. Earlier, in 2014, the Lazarus Group was blamed for the Sony Pictures hack that exposed internal emails after the studio released the film The Interview, which depicted an assassination plot against Kim Jong Un.
Why the focus on North Korea?
Experts argue that the isolated regime relies on illicit cyber activities to fund its government, a claim Pyongyang consistently denies. The nation’s intelligence agency allegedly recruits top university students and channels them into hacker groups, sometimes operating from facilities just across the border in China. The sophistication of the Binance attack – including novel laundering patterns – underscores the evolving capabilities of these actors.
Emerging threats and the role of AI
Analysts note that advances in artificial intelligence are giving threat actors new tools for automation and evasion, potentially accelerating the speed and scale of future attacks. As Chainalysis observed, the laundering techniques used in the Binance breach were unprecedented, hinting at a broader shift in cyber‑crime tactics.
What this means for crypto users
For individuals and institutions holding digital assets, the Binance breach serves as a stark reminder of the importance of robust security practices. While the exchange is working to recover the remaining funds, the incident highlights the systemic risks posed by state‑sponsored hacking groups and the need for ongoing vigilance across the cryptocurrency ecosystem.