What We Know About North Korea's Alleged Role in the Binance Hack

Binance, the world's largest cryptocurrency exchange, is still trying to recover from a $6.3bn (£4.7bn) hack, and two blockchain analytics firms say the evidence points squarely at North Korea, according to the BBC.

TRM Labs and Chainalysis each say they have identified the Lazarus Group — also known as TraderTraitor — "with high confidence" as the likely culprit, the BBC reported. Binance itself has not directly confirmed the North Korea link to the outlet.

Who is the Lazarus Group?

The Lazarus Group is a North Korean state-backed hacking unit that experts say has been recruited through the country's universities and is overseen by North Korea's intelligence agency, the BBC reported, citing unnamed reports. The same group, operating under the alias TraderTraitor, was blamed by the FBI last year for the theft of $1.5bn from the Bybit exchange. After that heist, the agency said the group moved quickly to launder and disperse the stolen assets, converting them into Bitcoin and other digital currencies with the eventual goal of cashing out in hard currency.

How did the attackers allegedly get into Binance?

According to TRM Labs' analysis cited by the BBC, the attackers are accused of using a special authorization to convert a Binance "hot wallet" — a wallet connected to the internet, as opposed to offline "cold" storage — into one that automatically funneled funds to the attacker. TRM said it is likely the intruder first gained access to Binance's hot-wallet signing system, the mechanism that approves outgoing transactions.

Binance's account of the breach has shifted. The company initially said it believed an engineer's laptop had been compromised, allowing unauthorized withdrawals, but later broadened that explanation. "Our subsequent investigation has uncovered additional points of breach," Binance co-CEO Richard Teng said, according to the BBC.

Has North Korea been accused of crypto theft before?

Repeatedly. Beyond the $1.5bn Bybit theft, North Korean hackers are also suspected in the 2022 theft of $620m in cryptocurrency, the BBC reported. The FBI has broadly accused North Korea of "illicit cybercrime and virtual asset theft activities." Some of that hacking work reportedly takes place just across North Korea's border in China, according to tech-industry analysis cited by the BBC.

North Korea is one of the poorest countries in the world, with internet access severely restricted for most citizens, the BBC noted — a backdrop experts say helps explain why the government of leader Kim Jong Un has leaned on state-backed hacking to raise money, something Pyongyang has long denied doing.

What has Binance recovered so far?

A Binance spokesperson said Friday that roughly 80% of the stolen assets have been secured, the BBC reported, though the remainder is still unaccounted for.

Is this the same pattern as North Korea's other hacks?

Not all of Pyongyang's most notorious cyber operations have been about money. The BBC pointed to the 2014 hack of Sony Pictures — tied to the studio's film The Interview, which depicted a plot to assassinate Kim — as the country's most spectacular suspected intrusion, one that exposed thousands of internal studio emails rather than stealing funds. The Binance case, by contrast, fits the financially motivated pattern the FBI has attributed to TraderTraitor and the Lazarus Group in recent years.