North Korean Lazarus Group Tied to $6.3 bn Binance Hack
Two blockchain analytics firms say a North Korean state‑backed hacking unit is the prime suspect in the massive Binance breach.
Two leading blockchain analytics firms have pointed to a North Korean state‑backed hacking unit as the most likely culprits behind the $6.3 bn theft from Binance, the world’s largest cryptocurrency exchange.
TRM Labs and Chainalysis both named the Lazarus Group—also referred to as TraderTraitor—with high confidence as the actors behind the breach.
The incident follows a pattern of North Korean cyber activity that has drawn international scrutiny. Last year the FBI publicly attributed a $1.5 bn theft from the Bybit exchange to North Korea, noting that the group known as TraderTraitor moved quickly to launder the proceeds, converting them into Bitcoin and other digital assets with the aim of eventually turning them into hard currency.
The FBI has broadly accused North Korea of “illicit cybercrime and virtual asset theft activities,” a charge that aligns with reports that the regime systematically develops cyber operations by recruiting top university students and channeling them into hacker groups overseen by its intelligence agency.
Analysts say some of the cyberwarfare is conducted just over the border in China, highlighting the transnational nature of the operations.
While the Binance hack is the latest high‑profile case, the source material notes that North Korea’s most spectacular suspected hack to date occurred in 2014, when the Sony Pictures studio—then involved with the film The Interview—was breached, exposing thousands of internal emails.
Overall, the pattern suggests that North Korean hacking groups, including Lazarus, focus heavily on monetary gain, using stolen crypto to fund the regime despite its severe internet restrictions and widespread poverty.
