coindesk.com
A North Korean hacking unit seems to be responsible for stealing over $6 billion in crypto assets from the world's biggest exchange, Binance, according to several blockchain sleuths and analysis firms.
North Korea’s Lazarus Group is a state-sanctioned hacking squad known for stealing money via cyber attacks to fund the rogue state’s illicit weapons program.
Blockchain investigator ZachXBT said in a post on X (formerly Twitter) that the attacker was "likely Lazarus." Blockchain analytics firm TRM published a blog post late Thursday saying the North Korean hacking group TraderTraitor — a subunit of Lazarus — was likely behind the hack, saying it had "high confidence" in that assessment.
Ido Ben-Natan, the co-founder and CEO of crypto security firm Blockaid, said in a statement to CoinDesk that "the tactics and level of sophistication we've seen so far are consistent with the kinds of operations we've seen from DPRK."
"DPRK-linked actors have been tied to several of the major crypto hacks this year, including the Kelp DAO, Bitget and Drift incidents this year," Ben-Natan said.
An individual familiar with crypto investigations told CoinDesk that there were "very few actors who could pull something like this off," but cautioned that the hack was not definitively attributed to Lazarus yet. Lazarus and other DPRK hacking groups are usually faster and more efficient in moving and selling stolen crypto funds than the Binance hackers were on Thursday, they said.
North Korea has been linked to most, if not all, of crypto's biggest hacks. The Lazarus Group is perhaps the best-known threat actor operating in the crypto space, known for orchestrating devastating hacks, including the $1.46 billion hack of Dubai-based crypto exchange Bybit last year.
At the time of the attack in February 2025, it was the largest such attack in history, and made up the bulk of the $2.02 billion in crypto stolen over the course of last year. The Lazarus Group is also believed to be responsible for other large crypto attacks, including the $292 million exploit of KelpDAO in April, and the $625 million hack of the Ronin Network in 2022.
Binance said in a late Thursday update that it had traced the attack vector to a compromised DevOps engineer's laptop.
