By Fatma Younis
Two major blockchain analytics firms have identified North Korea's state-backed Lazarus Group as the likely culprit behind the $6.3 billion hack of Binance, the world's largest cryptocurrency exchange.
High-confidence attribution
TRM Labs and Chainalysis said they have robust intelligence pointing to the Lazarus Group, also known as TraderTraitor, with high confidence. The hack is the latest in a series of cybercrimes linked to North Korea.
Pattern of state-sponsored cybercrime
Experts accuse Kim Jong Un's government of relying on cybercrime to finance itself, a claim Pyongyang denies. Previous incidents include the 2014 Sony Pictures hack and the $1.5 billion Bybit theft last year, which the FBI attributed to North Korea.
Sophisticated laundering techniques
In the Binance breach, attackers allegedly used a special authorization to turn a hot wallet into an automated fund-moving tool. TRM Labs said the attacker likely gained access to Binance's hot wallet signing system. Chainalysis noted laundering patterns not seen before, possibly aided by artificial intelligence.
Binance response and recovery
Binance co-CEO Richard Teng said the investigation uncovered additional breach points beyond an initial compromised engineer's laptop. A spokesperson said 80% of stolen assets have been secured, but the remainder is unaccounted for.
