Two major blockchain analytics firms say they have strong intelligence pointing to a North Korean state-backed group as the likely culprits in the $6.3bn (£4.7bn) hack of Binance, the world's largest cryptocurrency exchange.
TRM Labs and Chainalysis identified the Lazarus Group, a North Korean hacking unit also known as TraderTraitor, as the suspect. TRM Labs said it had identified the group “with high confidence.”
A Pattern of Suspected Attacks
The incident is the latest linked to North Korea, one of the poorest countries in the world, where access to the internet is severely restricted.
Experts accuse the government of leader Kim Jong Un of relying on cybercrime to finance itself. Pyongyang has long denied this.
The country's most high-profile suspected hack took place in 2014, although it was not financially motivated. The target was Sony Pictures, which had made the Hollywood film The Interview. The film involves a plot to assassinate Kim. The hack exposed thousands of embarrassing emails exchanged among the studio's top executives.
Earlier Thefts
Last year, the US Federal Bureau of Investigation (FBI) said North Korea was responsible for the theft of $1.5bn from the Bybit exchange. After that incident, the agency said TraderTraitor moved quickly to launder and disperse the stolen assets, converting them into Bitcoin and other digital assets with the aim of eventually turning them into hard currency.
The FBI has broadly accused North Korea of “illicit cybercrime and virtual asset theft activities.”
North Korean hackers are also suspected of stealing $620m worth of cryptocurrency in 2022. According to reports, the country has systematically developed its cyber operations, recruiting promising university students and placing them in hacker groups overseen by its intelligence agency. Some of this cyberwarfare reportedly takes place just across the border in China, according to analysis from tech groups.
How the Binance Attack Allegedly Worked
In the latest heist, North Korean agents are accused of using a special authorisation to turn a Binance hot wallet, which is connected to the internet, into one that moved funds automatically to the attacker. TRM Labs said the attacker likely gained access to Binance's hot wallet signing system as part of the scheme.
Binance has not directly responded to the BBC's questions about the incident's potential links to North Korea. The company initially said an engineer's laptop may have been compromised, allowing unauthorised withdrawals. It later said the attack was wider.
“Our subsequent investigation has uncovered additional points of breach,” said Binance co-CEO Richard Teng.
A Binance spokesperson said on Friday that some 80% of the stolen assets had been secured. The rest remains unaccounted for.
Role of Artificial Intelligence
If the accusations are true, the record heist shows how powerful suspected North Korean hackers have become, and how sharp the tools of the trade have grown.
Experts say the rise of artificial intelligence has also given threat actors new ways to commit crime through automation and other means. In this case, it is plausible that AI was used to infiltrate Binance's systems.
Chainalysis said the attacker used laundering patterns “we have not seen before.”
