Two leading firms specialising in cryptocurrency technology analysis have announced that they possess strong evidence linking a cyberattack on Binance, in which $6.3 billion was stolen, to a group backed by North Korea.
TRM Labs and Chainalysis have identified the North Korean hacking group Lazarus Group, also known as “TraderTraitor”, with a high degree of confidence as the most likely perpetrators of the attack on the world’s largest cryptocurrency exchange, BBC reports, as cited by RKS News.
The attack significantly surpasses the previous record: the 2025 theft from the Bybit platform, in which $1.5 billion was stolen.
This incident is the latest in a series of cyberattacks linked to North Korea, one of the world’s poorest countries, where internet access is heavily restricted. Experts accuse the government of Kim Jong Un of relying on cybercrime to finance the state, an allegation that Pyongyang has repeatedly denied.
North Korea recruits elite university students and directs them towards hacking groups supervised by intelligence services. Analyses by technology firms indicate that some of these operations are conducted in neighbouring China.
North Korean hackers are also suspected of stealing approximately $620 million worth of cryptocurrency during 2022.
In the latest theft, North Korean agents are accused of exploiting a specific authorisation mechanism to reconfigure a Binance “hot wallet” — a cryptocurrency wallet connected to the internet — so that it would automatically transfer funds to the attacker.
TRM suggests that the attacker may have gained access to Binance’s transaction-signing system as part of the operation.
The company initially stated that an engineer’s computer had been compromised, allowing unauthorised withdrawals to take place. However, it later acknowledged that the attack had a much broader scope.
In this case, artificial intelligence may also have been used to breach Binance’s systems.
Chainalysis stated that the attacker employed money-laundering techniques “of a kind we have never seen before”.
