Why North Korea's 'elite' hackers are the prime suspect in major Binance hack

What the report says

Two blockchain analytics firms, TRM Labs and Chainalysis, told BBC World News they have strong evidence pointing to North Korea’s Lazarus Group, also known as TraderTraitor, as the likely culprit behind the $6.3bn hack of Binance, the world’s largest cryptocurrency exchange. The report says the suspected state-backed unit was identified with high confidence, though Binance has not directly confirmed that assessment.

According to the BBC’s account, the attack targeted a Binance hot wallet and appears to have involved unauthorized access to the exchange’s signing system, allowing funds to be moved out automatically. Binance first suggested an employee laptop may have been compromised, but later said its investigation found more breach points. The company said about 80% of the stolen assets had been secured, while the remainder was still missing.

The article places the case in the wider context of North Korea-linked cybercrime, which experts and U.S. authorities say has been used to generate revenue for the isolated state. It notes that the FBI previously blamed North Korea for a major crypto theft from Bybit and has accused the country of illicit virtual-asset theft. Pyongyang has long denied such allegations.

If confirmed, the Binance case would rank among the biggest cryptocurrency thefts ever and would reinforce concerns that North Korea’s hacking operations have become more sophisticated. The BBC also cites experts saying that tools such as artificial intelligence may be helping threat actors carry out more complex cyberattacks.