TRM Labs and Chainalysis Blame North Korea for $6.3bn Binance Hack

Two of the biggest names in blockchain forensics — TRM Labs and Chainalysis — say they've identified North Korea's Lazarus Group, "with high confidence," as the likely culprit behind the $6.3bn (£4.7bn) hack of Binance, the world's largest cryptocurrency exchange.

The attribution puts the heist on a growing ledger of state-linked cybercrime. It also lands at a moment when security experts say hacking tools — supercharged by artificial intelligence — have never been sharper.

Who is the prime suspect?

The Lazarus Group, also tracked under the alias TraderTraitor, is a North Korean hacking unit that Western investigators have tied to a string of record-breaking crypto thefts. TRM Labs and Chainalysis both said their intelligence robustly points to the group in the Binance case.

The scale is hard to overstate. The incident matches a pattern the FBI has documented for years. Last year, the bureau publicly attributed the theft of $1.5bn from the Bybit exchange to North Korea. In that case, the FBI said TraderTraitor moved quickly to launder and disperse the stolen assets — converting them into Bitcoin and other digital assets with the goal of eventually turning them into hard currency.

The FBI has accused North Korea broadly of "illicit cybercrime and virtual asset theft activities." Pyongyang has long denied relying on cybercrime to finance the state.

The takeaway: this isn't a one-off attack, but the latest entry in a sustained, state-run revenue operation.

How did the attackers breach Binance?

According to the accusations, North Korean agents used a special authorisation to turn a Binance hot wallet — one connected to the internet — into a wallet that moved funds automatically to the attacker.

TRM said it's likely the attacker gained access to Binance's hot wallet signing system as part of the scheme.

Binance's own account of the breach has evolved. The company initially said it believed an engineer's laptop had been compromised, allowing unauthorised withdrawals. It later widened the scope. "Our subsequent investigation has uncovered additional points of breach," Binance co-CEO Richard Teng said.

The company has not directly responded to the BBC's queries about the incident's potential links to North Korea.

The takeaway: the attackers didn't smash a single lock — they appear to have worked through Binance's authorisation machinery itself.

How much money has been recovered?

A Binance spokesperson said on Friday that some 80% of the stolen assets have been secured. The rest remains unaccounted for.

That leaves roughly a fifth of a $6.3bn haul still moving through the financial system — potentially toward the laundering pipelines the FBI described after the Bybit theft.

Chainalysis flagged a detail that should worry every exchange: the attacker used laundering patterns "we have not seen before." Novel laundering techniques make recovered funds harder to trace and freeze.

The takeaway: an 80% recovery is significant, but the untracked remainder shows how fast stolen crypto can slip out of reach.

Why does North Korea keep showing up in crypto hacks?

North Korea is one of the poorest countries in the world, and access to the internet there is severely restricted. Experts accuse the government of leader Kim Jong Un of relying on cybercrime to finance itself — an accusation Pyongyang has long denied.

The country has systematically built its cyber operations, according to reports: it recruits the most promising students from universities and channels them into hacker groups overseen by North Korea's intelligence agency. Analysis from tech groups suggests some of the cyberwarfare actually takes place just over the border, in China.

Much of the activity centres on monetary gain. Beyond the Bybit case, North Korean hackers are also suspected in the theft of $620m worth of cryptocurrency in 2022.

The suspected hacking history stretches back further than crypto. The nation's most spectacular suspected hack, though not financial, hit Sony Pictures in 2014 — after the studio made the Hollywood film The Interview, which involves a plot to assassinate Kim. The breach exposed thousands of embarrassing emails exchanged among the studio's top executives.

The takeaway: crypto theft is now the funding engine of a programme that has run for more than a decade.

What role did AI play?

Experts say the rise of artificial intelligence has handed threat actors new ways to carry out crime, through automation and other means. In the Binance case specifically, it's plausible that AI was used to infiltrate the exchange's systems.

If the accusations hold, the record-making heist shows just how powerful suspected North Korean hackers have become — and how much sharper the tools of the trade have grown.

For exchanges, the signal is blunt: novel laundering patterns, possible AI-assisted infiltration and automated wallet-draining techniques are now part of the threat model, and the next attribution cycle may come too late to matter.