The key facts
- TRM Labs and Chainalysis with high confidence name the DPRK-linked Lazarus group (TraderTraitor) as the likely culprit of the $6.3 billion Binance hack
- Binance reported the recovery of about 80% of the stolen assets; earlier the company first suggested an engineer's laptop had been compromised, then acknowledged a broader attack
- The FBI previously held North Korea responsible for the theft of $1.5 billion from the Bybit exchange
The biggest hack in the history of the crypto market
Two leading blockchain analytics companies — TRM Labs and Chainalysis — said they link the hack of the Binance crypto exchange worth $6.3 billion (£4.7 billion) to the North Korean Lazarus Group, also known as TraderTraitor, with 'high confidence'. BBC News reports this citing both companies. If the accusations are confirmed, it would be a record theft in the history of the crypto industry, carried out by hackers from a country with strictly limited internet access.
How the attackers operated
According to the investigations, the agents used special authorization to turn Binance's 'hot' wallet, connected to the internet, into a wallet that automatically transferred funds to the attacker. TRM Labs considers it likely that the attacker gained access to the hot wallet's transaction signing system. Chainalysis notes that the attacker used money laundering schemes 'we have not seen before'; experts allow that artificial intelligence may have been used to penetrate Binance's systems, although this is only an analysts' assumption, not an established fact.
Binance's response and the fate of the funds
Binance did not directly respond to BBC inquiries about a possible connection between the incident and North Korea. The company initially suggested that an engineer's laptop had been compromised, allowing unauthorized withdrawals of funds, but later admitted the attack was broader. 'Our subsequent investigation revealed additional points of breach,' said Binance co-CEO Richard Teng. On Friday, a representative of the exchange said that about 80% of the stolen assets had already been secured, while the rest remains unaccounted for.
The trail of North Korean hackers
The accusations against North Korea fit an established pattern: last year the FBI stated that North Korea was responsible for the theft of $1.5 billion from the Bybit exchange and noted that the TraderTraitor group quickly laundered and dispersed the stolen assets, converting them into Bitcoin and other digital assets for subsequent conversion into 'hard' currency. According to BBC, experts accuse Kim Jong Un's government of financing the state through cybercrime — Pyongyang denies this. Earlier, North Korean hackers were suspected of stealing $620 million worth of cryptocurrency in 2022 and of the Sony Pictures hack in 2014. According to available reports, the country recruits promising students into hacker groups under intelligence supervision, and some operations are conducted from the territory of neighboring China.
Image source, Reuters 
