Two leading blockchain intelligence companies say they have uncovered strong evidence linking North Korea’s notorious Lazarus Group to a cyberattack on Binance that allegedly resulted in the theft of $6.3 billion in cryptocurrency, making it the largest known cryptocurrency heist in history.
TRM Labs and Chainalysis, both specializing in tracking cryptocurrency transactions and investigating blockchain-related crime, have independently identified the Lazarus Group, also known as TraderTraitor, as the most likely group behind the attack.
The findings, reported by the BBC, point toward a sophisticated operation potentially involving individuals connected to North Korea’s intelligence services.
If the findings are confirmed, the incident would represent an extraordinary escalation in cryptocurrency-related cybercrime, surpassing the previous record set by the 2025 attack on Bybit, in which approximately $1.5 billion was stolen.
Who Is the Lazarus Group?
The Lazarus Group is one of the most widely known and closely monitored hacking organizations in the world. Security researchers have repeatedly associated the group with cyberattacks targeting financial institutions, cryptocurrency exchanges and other major organizations.
The group is believed to operate with support from the North Korean government, although Pyongyang has consistently denied accusations that it sponsors international cybercrime.
Unlike traditional criminal organizations, which may focus on individual victims or relatively small financial targets, Lazarus-linked operations have been associated with attacks involving major financial infrastructure and digital asset platforms.
The group is also known by the name TraderTraitor, a designation used in investigations involving North Korean cyber actors targeting cryptocurrency businesses.
Why North Korea Is Suspected
North Korea is one of the world’s most isolated countries, with severe restrictions on internet access for the general population.
However, cybersecurity researchers believe the country has developed specialized teams of highly trained computer experts capable of carrying out complex international operations.
According to security analysts, talented university students are identified and recruited into programs that eventually direct some of them toward government-linked hacking units.
These operations are believed to be supervised by intelligence agencies, with certain activities reportedly taking place outside North Korea, including in neighboring China.
The alleged financial motivation is particularly significant.
North Korea faces extensive international sanctions and limited access to the global financial system. Researchers and government officials have repeatedly accused the country of using cybercrime to obtain funds that could support state activities.
The North Korean government has rejected these allegations.
How the $6.3 Billion Binance Attack Was Carried Out
Investigators believe the attackers exploited a weakness involving one of Binance’s cryptocurrency storage systems.
The operation reportedly targeted a so-called hot wallet, a type of digital wallet connected to the internet that allows cryptocurrency exchanges to process transactions and make funds available for withdrawals.
Hot wallets are essential to the daily operations of large exchanges because they allow users to deposit and withdraw digital assets without waiting for funds to be moved from offline storage.
However, their internet connection also creates additional security challenges.
According to the findings presented by TRM Labs, the attackers may have obtained access to Binance’s transaction-signing infrastructure, allowing them to manipulate the authorization process used to approve transfers.
The Role of a Compromised Authorization System
Rather than simply attempting to break into a wallet and transfer funds directly, the attackers allegedly exploited a specific authorization mechanism.
Investigators believe they managed to use a particular permission to change how one of Binance’s hot wallets was configured.
This reportedly allowed the wallet to automatically redirect funds toward an address controlled by the attackers.
Such an approach would represent a sophisticated attack because cryptocurrency transactions normally require multiple security checks before they can be completed.
If attackers manage to interfere with the systems responsible for approving those transactions, they may be able to make unauthorized transfers appear legitimate to parts of the infrastructure.
TRM Labs suggested that gaining access to Binance’s transaction-signing system was likely an important part of the operation.
The precise technical details of the compromise, however, have not been fully established publicly.
Binance Initially Pointed to an Engineer’s Computer
In its initial explanation, Binance indicated that an engineer’s computer had been compromised, potentially allowing unauthorized withdrawals to take place.
However, the company later acknowledged that the incident involved a broader security issue than initially understood.
That development raised further questions about how attackers could have moved through the exchange’s internal systems and whether weaknesses in its authorization infrastructure played a central role.
For cryptocurrency exchanges, such incidents demonstrate that protecting digital assets involves much more than securing individual wallets.
Internal employee devices, access permissions, transaction approval procedures and monitoring systems can all become potential entry points for sophisticated attackers.
Chainalysis Identifies Unusual Money-Laundering Methods
Another important aspect of the investigation concerns what happened to the stolen cryptocurrency after the attack.
Chainalysis reported that the attackers used money-laundering techniques it described as methods of a kind the company had not previously encountered.
Although blockchain transactions are publicly recorded, identifying the individuals controlling particular wallet addresses can be extremely challenging.
Criminal groups frequently move funds through multiple wallets, exchange assets and use complicated transaction patterns in an attempt to make the original source of the money harder to identify.
The unusual techniques identified by Chainalysis suggest that investigators may be dealing with an operation involving a particularly sophisticated approach to concealing stolen assets.
Blockchain intelligence companies monitor these movements by examining transaction histories, identifying connections between wallet addresses and looking for patterns associated with known criminal networks.
Their findings can help exchanges and authorities identify suspicious funds and potentially prevent stolen cryptocurrency from being converted into conventional money.
A Growing Pattern of North Korean Cryptocurrency Theft
The alleged Binance incident is part of a much wider pattern of cyberattacks that researchers have linked to North Korean hacking groups.
One particularly notable case occurred in 2022, when North Korean-linked hackers were suspected of stealing approximately $620 million in cryptocurrency.
The following years brought further concerns as cryptocurrency thefts became increasingly large and technically complex.
The 2025 Bybit incident, involving approximately $1.5 billion, had already established a record for the largest cryptocurrency theft publicly reported at the time.
The alleged $6.3 billion Binance attack would represent a dramatic increase over that figure.
It would also highlight the growing financial impact of cyber operations targeting the cryptocurrency industry.
