Binance blames North Korean hackers

TRM Labs and Chainalysis have identified the Lazarus Group as the prime suspect in the $6.3 billion hack of Binance. Both blockchain analytics firms stated they have strong intelligence pointing to the North Korean state-backed unit, also known as TraderTraitor, as the perpetrator. TRM Labs identified the group with high confidence, while Chainalysis reached a similar conclusion based on its own data.

The incident marks the largest theft in the history of cryptocurrency exchanges. Binance, the world's largest digital asset platform, initially told the public that an engineer's laptop had been compromised. That explanation changed quickly. Richard Teng, Binance's co-CEO, said the company's investigation uncovered additional points of breach. He noted that the attackers used a special authorization to turn a Binance hot wallet into one that automatically moved funds to the attacker.

Experts say North Korea has a long history of using cybercrime to finance its government. The country is one of the poorest in the world and restricts internet access for its citizens. The FBI accused North Korea of stealing $1.5 billion from the Bybit exchange last year. In that case, the FBI said the hackers quickly laundered the stolen assets by converting them to Bitcoin and other digital assets. North Korean hackers are also suspected in the theft of $620 million worth of cryptocurrency in 2022.

The Lazarus Group gained international attention in 2014 after a suspected hack on Sony Pictures. That attack exposed thousands of emails among studio executives following the release of the film The Interview. Since then, reports indicate that North Korea has systematically developed its cyber operations by recruiting promising university students. These individuals are often channeled into hacker groups overseen by the national intelligence agency. Some of this cyberwarfare is conducted just over the border in China.

Binance has not directly responded to queries about the potential links to North Korea. However, a company spokesperson said on Friday that 80 percent of the stolen assets have been secured. The remaining portion remains unaccounted for. Chainalysis noted that the attacker used laundering patterns the firm had not seen before. Experts suggest that the rise of artificial intelligence may have allowed the threat actors to infiltrate Binance's systems more effectively.

The FBI has broadly accused North Korea of illicit cybercrime and virtual asset theft activities. The agency stated that the hackers aimed to turn stolen digital assets into hard currency. This latest heist demonstrates the growing power of the suspected North Korean hacking teams. The tools of the trade have become sharper, allowing for larger and more complex financial crimes.