Two major blockchain analytics firms have found strong evidence linking a North Korean state-backed hacking group to a massive $6.3 billion (£4.7 billion) cyber heist targeting Binance, the world’s largest cryptocurrency exchange.
TRM Labs and Chainalysis have both identified the Lazarus Group, a North Korean hacking unit also known as TraderTraitor, as the primary suspect behind the breach, with “high confidence”.
The record-breaking heist highlights the growing technical capabilities and sophistication of suspected North Korean hackers. Security analysts say the rise of artificial intelligence (AI) has given cybercriminals new capabilities through automation and other techniques, raising the possibility that AI was used to breach Binance’s systems, reports BBC.
Chainalysis noted that the perpetrators used money-laundering methods that the firm had “not seen before”.
The incident is the latest cyber operation linked to North Korea, a country with severely restricted internet access and one of the world’s poorest economies. Experts accuse the government of leader Kim Jong Un of using cybercrime to generate state revenue, an allegation Pyongyang has long denied.
Reports suggest North Korea systematically develops its cyber capabilities by recruiting high-performing university students and assigning them to hacking units overseen by the country’s intelligence agency. Technology groups have also indicated that some operations are conducted across the border in China, with much of the activity focused on financial gains.
North Korean operatives have been linked to several major cyberattacks over the past decade.
In 2014, the regime was linked to a non-financial attack on Sony Pictures following the studio’s production of The Interview, a Hollywood film depicting a plot to assassinate Kim Jong Un. The breach exposed thousands of embarrassing emails exchanged among senior studio executives.
In 2022, North Korean hackers were suspected of stealing $620 million worth of cryptocurrency. Last year, the Federal Bureau of Investigation (FBI) held North Korea responsible for a $1.5 billion heist targeting the Bybit exchange.
Following that attack, the FBI said TraderTraitor moved quickly to launder and distribute the stolen assets, converting them into Bitcoin and other digital tokens to obtain hard currency. The agency has broadly accused North Korea of engaging in “illicit cybercrime and virtual asset theft activities”.
In the Binance attack, North Korean agents are accused of exploiting special authorisation to manipulate an internet-connected “hot wallet”, turning it into an automated system that transferred funds directly to the attacker.
TRM Labs said the perpetrator had likely gained access to Binance’s hot wallet signing system as part of the operation.
Binance initially said it believed an engineer’s laptop had been compromised, allowing unauthorised withdrawals. However, the exchange later acknowledged a wider intrusion.
“Our subsequent investigation has uncovered additional points of breach,” Binance co-chief executive officer Richard Teng said.
A Binance spokesperson confirmed on Friday that approximately 80% of the stolen assets had been secured, while the remaining funds were still unaccounted for.
Binance did not directly respond to BBC queries about potential links between the incident and the region.
