In a cryptocurrency world built on the promise that no one can quietly rewrite the ledger, two of the field's most watched analytics firms now point at a state-backed unit in North Korea as the likely author of the largest digital theft on record. The alleged hand reached into Binance, the planet's biggest crypto exchange, through a hot wallet that lives permanently online, and drained roughly $6.3bn. The attribution remains a claim rather than a verdict, and Binance has yet to answer it directly. It joins a long line of suspected heists that suggest a nation short on almost everything has fou
Blockchain analysts link North Korea's Lazarus Group to $6.3bn Binance hack
The rest remains unaccounted for.
Mark
Two firms are pointing at North Korea. How strong is that?
Mimi
Both TRM Labs and Chainalysis say they have robust intelligence, and TRM used the words "high confidence." That's meaningful, since they're independent analytics firms reaching the same view.
Luke
But it's still attribution by private firms. The report doesn't cite a government finding for this hack, and Binance hasn't directly responded on the North Korea link. "Likely culprit" is the honest phrasing.
Mark
What do we know about how the attack worked?
Mimi
The accusation is that a special authorisation was used to turn a hot wallet into one that moved funds automatically to the attacker. TRM thinks the signing system was likely accessed.
Luke
Note the hedges: "accused," "likely." And Binance's story has changed. First a compromised engineer's laptop, then "additional points of breach." The full picture isn't public.
Mark
Why does the Bybit case matter here?
Mimi
The FBI attributed the $1.5bn Bybit theft to North Korea last year and described TraderTraitor quickly laundering the proceeds into Bitcoin and other assets. That's the template analysts are comparing against.
Luke
Yet Chainalysis says the laundering patterns here are ones it hasn't seen before. So the pattern match isn't simple, and that cuts both ways.
Mark
And the AI angle?
Mimi
Experts say AI gives attackers automation and other tools, and the BBC calls it plausible that it was used here.
Luke
Plausible isn't confirmed. Nothing in the reporting shows AI was actually used. And the 80% secured figure is Binance's own statement; the rest is unaccounted for.
The Pulse
- Two leading blockchain analysts have named North Korea's Lazarus Group as the likely attacker of a $6.3bn Binance theft, raising the stakes of an already alarming breach.
- An authorisation meant for routine operations was allegedly bent into a tool that let a hot wallet move funds on its own, turning a trusted system against its owner.
- Binance's account has widened from one compromised engineer's laptop to multiple points of breach, and roughly a fifth of the stolen assets remains unaccounted for.
- Investigators are racing to confirm formal attribution, while questions about AI-assisted intrusion hover unresolved over the still-open investigation.
In a cryptocurrency world built on the promise that no one can quietly rewrite the ledger, two of the field's most watched analytics firms now point at a state-backed unit in North Korea as the likely author of the largest digital theft on record. The alleged hand reached into Binance, the planet's biggest crypto exchange, through a hot wallet that lives permanently online, and drained roughly $6.3bn. The attribution remains a claim rather than a verdict, and Binance has yet to answer it directly. It joins a long line of suspected heists that suggest a nation short on almost everything has found in code a currency it can actually spend.
Two of the best-known blockchain analytics firms, TRM Labs and Chainalysis, now say they have strong intelligence that the $6.3bn theft from Binance, the world's largest crypto exchange, was carried out by the Lazarus Group, a North Korean state-backed unit also known as TraderTraitor. TRM says it reached that view with high confidence, and Chainalysis agrees.
The method, as described, targeted a hot wallet, one that stays connected to the internet. The attackers are accused of using a special authorisation to convert that wallet into one that moved funds automatically to them. Binance first blamed a compromised engineer's laptop, then said the breach ran wider. Its spokesperson says about 80% of the stolen assets have been secured, while the rest is still missing. Binance has not directly addressed the North Korean link.
If accurate, the attribution fits a familiar pattern. Experts accuse Pyongyang of using cybercrime to fund its government, which the regime denies. The arc has moved from the 2014 Sony Pictures hack, which was about embarrassment, toward theft on a far larger scale, including the $1.5bn taken from Bybit last year. Reports describe a deliberate effort to recruit talented students into intelligence-run hacking groups, with some activity said to occur just across the border in China.
Analysts also suspect artificial intelligence may have helped the intrusion, though that remains a possibility, not a finding. Chainalysis says the laundering patterns were unlike any it has seen. What comes next is a formal attribution from authorities, Binance's full findings, and whether AI's role is ever confirmed.
Two of the best-known blockchain analytics firms have now put the same name on the largest cryptocurrency theft on record. TRM Labs and Chainalysis both say they have strong intelligence that the $6.3bn (£4.7bn) hack of Binance, the world's largest crypto exchange, was carried out by the Lazarus Group, a North Korean state-backed unit also known as TraderTraitor. TRM said it identified the group "with high confidence." Chainalysis reached the same view.
The method, as the analysts describe it, centred on a Binance hot wallet, the kind that stays connected to the internet. North Korean agents are accused of using a special authorisation to turn that wallet into one that automatically moved funds to the attacker. TRM said it is likely the attacker got into Binance's hot wallet signing system as part of the scheme.
Binance's own account of the breach has shifted. The company first said it believed an engineer's laptop had been compromised, which allowed unauthorised withdrawals. It later said the attack went wider. "Our subsequent investigation has uncovered additional points of breach," co-CEO Richard Teng said. A Binance spokesperson said on Friday that about 80% of the stolen assets have been secured, but the remainder is unaccounted for. Binance has not directly responded to the BBC's questions about the possible North Korean link.
If the attribution holds, it fits a long pattern. Experts accuse the government of Kim Jong Un of relying on cybercrime to finance itself, something Pyongyang has long denied. North Korea is one of the poorest countries in the world, and internet access there is severely restricted. Its best-known suspected hack, in 2014, was not financial: the target was Sony Pictures, which had made The Interview, a film involving a plot to assassinate Kim. The attack exposed thousands of embarrassing emails among the studio's top executives.
Since then, the focus has largely moved to money. North Korean hackers are suspected in the theft of $620m in cryptocurrency in 2022. Last year, the FBI said North Korea was responsible for stealing $1.5bn from the Bybit exchange. After that theft, the agency said TraderTraitor moved quickly to launder and disperse the assets, converting them into Bitcoin and other digital assets with the aim of eventually turning them into hard currency. The FBI has broadly accused North Korea of illicit cybercrime and virtual asset theft.
Reports say the country has built its cyber capacity deliberately, recruiting promising university students and channelling them into hacking groups overseen by its intelligence agency. Analysis from tech groups indicates some of this work takes place just across the border in China.
The BBC notes that if the accusations are true, the heist shows how powerful the suspected hackers have become, and how much sharper the tools of the trade are. Experts say artificial intelligence has given threat actors new ways to commit crime, including through automation, and the BBC describes it as plausible that AI was used to infiltrate Binance's systems. That remains a possibility rather than an established finding. Chainalysis said the attacker used laundering patterns "we have not seen before."
What to watch next: whether a formal attribution follows from authorities, what Binance's full findings on the breach show, and whether AI-assisted intrusion is ever confirmed as part of the attack.
Notable Quotes
Our subsequent investigation has uncovered additional points of breach.— Richard Teng, Binance co-CEO
The attacker used laundering patterns it had not seen before.— Chainalysis (paraphrased)
Want the full story?
Read the original at BBC News ↗
Politics & Governance