Two blockchain analytics firms, TRM Labs and Chainalysis, have each pointed toward the same shadowy suspect in a $6.3bn theft from Binance, the world's largest cryptocurrency exchange: the Lazarus Group, a North Korean state-backed hacking unit also known as TraderTraitor. If their attribution holds, it would mark a record heist and reveal how far a poor, isolated state has learned to pull wealth out of a digital world it can barely enter. Yet the claim still rests on private analysts' confidence rather than official proof, and Binance has so far stayed silent, leaving the story suspended betw
Why North Korea's 'elite' hackers are the prime suspect in the $6.3bn Binance hack
Two firms, one suspect: a $6.3bn heist and a familiar name
Mark
Why are these two firms' findings getting so much attention?
Mimi
Because TRM Labs and Chainalysis are both major blockchain analytics firms, and each independently says it has high confidence in pointing to the Lazarus Group, also called TraderTraitor.
Luke
Careful with 'independently.' The reporting says both identified the group, but it doesn't say how they reached that or whether they share data. And 'high confidence' is their own wording, not a legal finding.
Mark
What did the attackers actually do?
Mimi
They're accused of using a special authorisation to turn a Binance hot wallet, one connected to the internet, into something that sent funds automatically to the attacker.
Luke
And TRM says it's 'likely' the attacker got into the hot wallet signing system. That's a probability, not an established fact.
Mark
Is there precedent for this?
Mimi
Yes. The FBI said North Korea was behind the $1.5bn Bybit theft last year, and said TraderTraitor moved fast to launder the proceeds. A $620m theft in 2022 is also suspected to be theirs.
Luke
Note that one is an FBI attribution and the other is only 'suspected.' They're not the same strength of claim. And for Binance, no government attribution is mentioned yet.
Mark
Has Binance said anything?
Mimi
Not directly. It hasn't responded to the BBC's questions about the possible links.
Luke
So we don't know Binance's view, and Pyongyang has long denied financing itself through cybercrime. The claims about recruiting students and operating from China come from reports and tech group analysis, not confirmed here.
Le Pouls
- Two respected analytics firms have named North Korea's Lazarus Group as the likely hand behind a record $6.3bn crypto theft from Binance.
- The attacker reportedly turned a connected hot wallet into an automatic payout channel, exploiting privileged access to its signing system.
- Binance has not answered direct questions about the suspected North Korean link, and the exchange's silence is fuelling uncertainty across the industry.
- Pyongyang denies using cybercrime to fund itself, while the pattern of past thefts like the $1.5bn Bybit hack raises pressure on US authorities to take a public position.
Two blockchain analytics firms, TRM Labs and Chainalysis, have each pointed toward the same shadowy suspect in a $6.3bn theft from Binance, the world's largest cryptocurrency exchange: the Lazarus Group, a North Korean state-backed hacking unit also known as TraderTraitor. If their attribution holds, it would mark a record heist and reveal how far a poor, isolated state has learned to pull wealth out of a digital world it can barely enter. Yet the claim still rests on private analysts' confidence rather than official proof, and Binance has so far stayed silent, leaving the story suspended between accusation and answer.
Two of the best-known blockchain analytics firms, TRM Labs and Chainalysis, have independently pointed to the same suspect in a $6.3bn (£4.7bn) hack of Binance, the world's largest cryptocurrency exchange. Both say they have identified the Lazarus Group, also called TraderTraitor, a North Korean state-backed hacking unit, "with high confidence." If the accusation holds, the theft would be a record, and a sharp measure of how capable suspected North Korean hackers have become.
The method, as reported, is precise. The attackers are said to have used a special authorisation to convert a Binance hot wallet, one connected to the internet, into a tool that automatically moved funds out to them. TRM believes the intruders likely gained access to the signing system behind that wallet. Binance has not directly answered the BBC's questions about any North Korean link.
The suspicion follows a familiar pattern. The FBI blamed North Korea for the $1.5bn theft from Bybit last year, and said the group moved quickly to launder the proceeds into Bitcoin and other digital assets to turn them into hard currency. North Korean hackers are also suspected in a $620m theft in 2022.
North Korea is among the poorest countries on earth, with severely restricted internet access, and experts accuse Kim Jong Un's government of relying on cybercrime to finance itself. Pyongyang has long denied it. Reports describe a deliberate system that recruits top university students into hacker groups run by its intelligence agency, with some activity reportedly based just across the border in China. Much of it has aimed at money, though not all: the 2014 attack on Sony Pictures, over the Hollywood film The Interview, was not financial.
For now, the attribution rests on two private firms' confidence, and Binance has not addressed the suspected links. Watch for whether the exchange responds, and whether US authorities, who made the Bybit attribution, take a position on this one.
Two of the best-known blockchain analytics firms, TRM Labs and Chainalysis, have each pointed to the same suspect in a $6.3bn (£4.7bn) hack of Binance, the world's largest cryptocurrency exchange: a North Korean state-backed hacking unit. Both say they identified the Lazarus Group, which is also known as TraderTraitor, "with high confidence." If the accusation holds, the theft would be a record, and a measure of how capable suspected North Korean hackers have become.
The mechanics, as described in the reporting, are specific. North Korean agents are accused of using a special authorisation to convert a Binance hot wallet, which is a wallet connected to the internet, into one that automatically moved funds to the attacker. TRM said it is likely the attacker gained access to the signing system of Binance's hot wallet as part of the scheme.
Binance has not directly responded to the BBC's questions about the incident's potential links to North Korea.
The suspicion fits a pattern. Last year the FBI said North Korea was responsible for the theft of $1.5bn from the Bybit exchange. After that incident, the agency said TraderTraitor moved quickly to launder and disperse the stolen assets, converting them into Bitcoin and other digital assets with the aim of eventually turning them into hard currency. The FBI has more broadly accused North Korea of "illicit cybercrime and virtual asset theft activities." North Korean hackers are also suspected in the theft of $620m worth of cryptocurrency in 2022.
North Korea is one of the poorest countries in the world, and access to the internet there is severely restricted. Experts accuse the government of Kim Jong Un of relying on cybercrime to finance itself. Pyongyang has long denied this.
According to reports, the country has built its cyber operations systematically, recruiting the most promising students from its universities and channelling them into hacker groups overseen by its intelligence agency. Analysis from technology groups indicates that some of this activity is carried out just across the border in China. Much of the hacking has centred on making money.
Not all of it has. The country's most spectacular suspected hack, in 2014, was not financial. The target was Sony Pictures, which had made The Interview, a Hollywood film involving a plot to assassinate Kim. The attack exposed thousands of embarrassing emails exchanged among the studio's top executives.
For now, the attribution rests on the confidence of two private analytics firms, and Binance has not directly addressed the suspected links. What to watch is whether the exchange responds on the question, and whether US authorities, which made the Bybit attribution last year, take a position on this one.
Citations marquantes
The Lazarus Group was identified with high confidence as the likely culprit.— TRM Labs and Chainalysis, as reported by the BBC
North Korea has long denied relying on cybercrime to finance its government.— Pyongyang, as reported by the BBC
Envie de l'histoire complète ?
Lire l'original sur BBC ↗