North Korean hackers prime suspects in record Binance theft
Two blockchain analytics firms say a North Korean state-backed group, Lazarus, is the likely culprit behind the $6.3bn hack of Binance, the world's largest cryptocurrency exchange. Pyongyang has long denied such accusations.
Blockchain analytics firms TRM Labs and Chainalysis have identified, "with high confidence", the North Korean state-backed hacking group Lazarus, also known as TraderTraitor, as the likely perpetrator of a $6.3bn (£4.7bn) hack of Binance, the world's largest cryptocurrency exchange. If the accusations prove true, the case shows how capable hackers linked to North Korea have become.
How the attack unfolded
North Korean agents are accused of using a special authorisation to convert a Binance hot wallet, which is connected to the internet, into one that automatically sent funds to the attacker. TRM said the attacker likely also gained access to Binance's hot wallet signing system.
Binance first said an engineer's laptop appeared to have been compromised, enabling unauthorised withdrawals, but later said the attack was broader. Co-CEO Richard Teng said the investigation had uncovered additional points of breach. A company spokesperson said on Friday that about 80% of the stolen assets had been secured, while the rest remains unaccounted for. Binance did not directly answer the BBC's questions on possible North Korean links.
Earlier incidents
Experts accuse the government of North Korean leader Kim Jong Un of relying on cybercrime to fund itself, which Pyongyang has long denied. Last year the FBI, the US Federal Bureau of Investigation, said North Korea was responsible for stealing $1.5bn from the Bybit exchange, after which TraderTraitor moved quickly to launder and disperse the assets by converting them into Bitcoin and other digital assets. North Korean hackers are also suspected in a $620m cryptocurrency theft in 2022. In 2014, Sony Pictures was hacked after producing The Interview, a film involving a plot to assassinate Kim.
Reports say the country has systematically built up its cyber capabilities, recruiting promising university students into hacking groups overseen by its intelligence agency. Tech groups' analysis suggests some of the activity takes place across the border in China.
Experts add that artificial intelligence has given attackers new ways to commit crime through automation, and it is plausible it was used to infiltrate Binance's systems. Chainalysis said the attacker used laundering patterns "we have not seen before".
