North Korean hackers suspected in $6.3bn Binance theft

Two blockchain analytics firms have identified a North Korean state-backed hacking group as the likely culprit behind a $6.3 billion theft from Binance, the world’s largest cryptocurrency exchange, according to the BBC.

TRM Labs and Chainalysis linked the attack to the Lazarus Group, also known as TraderTraitor, with high confidence. Their assessments point towards North Korean involvement but do not amount to a confirmed attribution by Binance.

A Binance spokesperson said on Friday that about 80% of the stolen assets had been secured. The remainder was still unaccounted for. The statement did not establish that the secured assets had been returned.

Investigation finds a wider breach

Binance initially said it believed an engineer’s laptop had been compromised, enabling unauthorised withdrawals. The company subsequently disclosed that the intrusion was broader than first thought.

“Our subsequent investigation has uncovered additional points of breach,” Binance co-chief executive Richard Teng said.

According to the BBC’s account, the attackers are suspected of exploiting a special authorisation to make a Binance hot wallet move funds automatically to an attacker-controlled destination. Hot wallets are connected to the internet.

TRM Labs said the attacker was likely to have gained access to Binance’s hot-wallet signing system. That remains an assessment of how the theft happened, rather than a definitive technical explanation from the exchange.

Binance had not directly answered the BBC’s questions about possible North Korean links. Chainalysis, meanwhile, said the attacker had used laundering patterns “we have not seen before”.

Why Lazarus is under suspicion

The attribution comes against a history of cryptocurrency thefts linked to North Korea. In the earlier Bybit case, the US Federal Bureau of Investigation said North Korea was responsible for stealing $1.5 billion from the exchange.

The FBI said TraderTraitor quickly moved to launder and disperse those stolen assets, converting them into Bitcoin and other digital assets with the aim of eventually turning them into hard currency.

North Korean hackers are also suspected of involvement in a $620 million cryptocurrency theft in 2022. Beyond digital currencies, the country was suspected in the 2014 attack on Sony Pictures, which exposed thousands of internal emails after the studio made The Interview, a film involving a plot to assassinate Kim Jong Un.

Experts have accused Kim’s government of using cybercrime to finance itself. Pyongyang has long denied such accusations.

Recovery and attribution remain separate questions

Binance’s account of securing most of the stolen assets offers an indication of progress in the recovery effort, but part of the $6.3 billion remains missing. Its acknowledgement of additional breaches also leaves the full route into its systems unresolved.

For now, the central distinction is between the analytics firms’ high-confidence identification of Lazarus and what Binance has publicly confirmed. The exchange has acknowledged a wider compromise, but has not itself confirmed the suspected North Korean connection.