Two major blockchain analytics firms identified the Lazarus Group, a North Korean state-backed hacking unit also known as TraderTraitor, "with high confidence" as the likely culprit in a $6.3bn theft from Binance, the world's largest cryptocurrency exchange, according to TRM Labs and Chainalysis.
North Korean agents are accused of gaining access to Binance's hot wallet signing system, which allowed them to turn an internet-connected wallet into one that moved funds automatically to the attacker, TRM said. Binance initially attributed the breach to a compromised engineer's laptop but later disclosed additional points of breach, according to co-CEO Richard Teng. About 80% of the stolen assets have been recovered, but the remainder remains unaccounted for.
The FBI previously linked North Korea to the theft of $1.5bn from the Bybit exchange last year and has broadly accused the country of "illicit cybercrime and virtual asset theft activities." North Korea has systematically developed cyber operations by recruiting students from universities and channeling them into hacker groups overseen by the nation's intelligence agency, according to reports. Some cyberwarfare takes place in China, near North Korea's border.
Chainalysis noted the attacker used laundering patterns "we have not seen before." Experts say artificial intelligence may have been used to infiltrate Binance's systems, with AI giving threat actors new ways to carry out crime through automation.