Blockchain analytics companies TRM Labs and Chainalysis have determined with high confidence that the Lazarus Group, a North Korean state-sponsored hacking unit also known as TraderTraitor, was behind a $6.3bn breach of Binance, the world’s largest cryptocurrency exchange. The attribution adds to a pattern of major cyber incidents linked to North Korea in recent years.
North Korea, one of the world’s poorest nations with heavily restricted internet access, has long been accused by international authorities of relying on cybercrime to fund government operations, allegations Pyongyang has consistently denied. The Federal Bureau of Investigation has broadly attributed illicit cybercrime and virtual asset theft activities to the country. In the prior year, the FBI said North Korea was responsible for stealing $1.5bn from the Bybit exchange, with the agency noting that hackers moved quickly to launder and convert the stolen assets into Bitcoin and other digital currencies for eventual conversion to traditional money.
The alleged Binance attackers reportedly gained access to the exchange’s hot wallet signing system, using special authorization to convert a connected internet-facing wallet into one that automatically transferred funds to the attacker. Binance initially attributed the breach to a compromised engineer’s laptop but subsequently acknowledged the attack was more extensive, with co-CEO Richard Teng stating that additional breach points were uncovered during investigation. The company reported securing approximately 80 percent of stolen assets, though the remainder has not been recovered.
Experts note that North Korea has systematically developed sophisticated cyber capabilities by recruiting top university students into hacker groups overseen by the nation’s intelligence agency, with some operations conducted across the border in China. North Korean hackers have been suspected in previous major thefts, including a $620m cryptocurrency heist. Analysts suggest that emerging technologies such as artificial intelligence may have enabled the attackers to execute the breach through enhanced automation and infiltration techniques, with Chainalysis observing that the laundering patterns used represented methods not previously documented.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI