Two blockchain analytics firms identified the Lazarus Group, a North Korean state-backed hacking unit, "with high confidence" as the likely perpetrator of a $6.3bn theft from Binance, the world's largest cryptocurrency exchange. TRM Labs and Chainalysis both attributed the hack to the group, also known as TraderTraitor.
The attackers gained access to Binance's hot wallet signing system and used special authorization to convert the wallet into one that moved funds automatically to them, according to TRM Labs. Binance co-CEO Richard Teng said the company's investigation "has uncovered additional points of breach" beyond the initially suspected compromised engineer's laptop. About 80% of stolen assets have been recovered, but the remainder remains unaccounted for.
The Federal Bureau of Investigation has previously linked North Korea to a $1.5bn theft from the Bybit exchange and broadly accused the country of "illicit cybercrime and virtual asset theft activities." The BBC reported that experts accuse North Korea's government of relying on cybercrime to finance itself, a claim Pyongyang has denied. North Korean hackers are also suspected in a $620m cryptocurrency theft in 2022.
Chainalysis noted the attacker used money laundering patterns "we have not seen before." Experts said artificial intelligence may have been used to infiltrate Binance's systems, adding that AI has given threat actors new capabilities for automation and other methods of carrying out crime.