North Korea's Lazarus Group linked to $6.3 billion Binance theft

Two blockchain‑analytics firms, TRM Labs and Chainalysis, have identified North Korea’s Lazarus Group – also known as TraderTraitor – as the “high‑confidence” suspect behind the $6.3 billion theft from Binance, the world’s largest cryptocurrency exchange. The hack, reported on Friday, involved unauthorized withdrawals from a Binance hot wallet that was linked to the internet.

The accusation comes amid growing evidence that Pyongyang relies on cybercrime to fund its regime. North Korea has been linked to a string of high‑profile attacks, from the 2014 Sony Pictures breach to a $1.5 billion theft from the Bybit exchange last year. The FBI has repeatedly warned that the country’s intelligence agency trains elite hackers and uses them to steal virtual assets, which are then laundered into hard currency. Analysts say much of the activity is coordinated from facilities just across the border in China, and that the Lazarus Group has a track record of targeting crypto platforms for monetary gain.

According to TRM Labs, the attackers exploited a special authorisation to convert a Binance hot wallet into a signing system that could move funds automatically. Binance initially blamed a compromised engineer’s laptop, but co‑CEO Richard Teng later said the breach was broader and uncovered additional points of entry. The exchange says roughly 80 percent of the stolen assets have been secured, but the remainder remain missing. Binance has not commented directly on the alleged North Korean link, while the U.S. authorities continue to investigate the flow of the stolen coins.

If the attribution holds, the hack marks the largest cryptocurrency theft ever recorded and underscores the vulnerability of hot wallets that are constantly online. Regulators are likely to tighten oversight of crypto exchanges and push for stricter controls on digital‑asset custody. Binance, for its part, is expected to overhaul its security protocols and work with law‑enforcement agencies to trace the remaining funds. The episode also raises fresh diplomatic pressure on North Korea, whose cyber‑operations have increasingly blurred the line between state‑sponsored espionage and organized crime.