OMM Newsroom
Two blockchain analytics firms say they have evidence pointing to a North Korean state-backed group as the likely culprit in the $6.3bn (£4.7bn) hack of “Binance”, the world’s largest cryptocurrency exchange, according to BBC World.
TRM Labs identified the Lazarus Group, also known as TraderTraitor, “with high confidence”. Chainalysis also linked the attack to the group.
The incident is the latest cybercrime case linked to North Korea, where internet access is severely restricted. Experts accuse the government of leader Kim Jong Un of relying on cybercrime to finance itself, an allegation Pyongyang has long denied.
One of the country’s most high-profile suspected hacks took place in 2014, when “Sony Pictures” was targeted after making the Hollywood film “The Interview”, whose plot involves an attempt to assassinate Kim. The attack exposed thousands of embarrassing emails exchanged by the studio’s top executives.
Last year, the FBI said North Korea was responsible for stealing $1.5bn from the “Bybit” exchange. The agency said TraderTraitor then moved quickly to launder and disperse the assets, converting them into Bitcoin and other digital assets with the aim of eventually turning them into hard currency.
The FBI has broadly accused North Korea of “illicit cybercrime and virtual asset theft activities”. Reports say the country has systematically developed its cyber operations by recruiting promising university students and directing them into hacker groups overseen by its intelligence agency. Technology groups have said some cyberwarfare operations take place across the border in China.
Much of North Korea’s hacking activity has focused on financial gain. Hackers from the country are also suspected of stealing $620m in cryptocurrency in 2022.
In the latest attack, North Korean agents are accused of exploiting a special authorisation to turn a “Binance” hot wallet, which is connected to the internet, into one that automatically transferred funds to the attacker. TRM said the attacker likely gained access to the exchange’s hot-wallet signing system.
“Binance” has not directly responded to BBC World’s questions about possible links between the attack and North Korea. The company initially said it believed an engineer’s laptop had been compromised, enabling unauthorised withdrawals, but later said the attack was broader.
“Our subsequent investigation has uncovered additional points of breach,” “Binance” co-CEO Richard Teng said.
About 80% of the stolen assets have been secured, a “Binance” spokesperson said on Friday. The rest remains unaccounted for.
If the accusations are true, the record-breaking theft would demonstrate the growing capabilities of suspected North Korean hackers, as the tools used in cyberattacks become more sophisticated.
Experts say artificial intelligence has also given threat actors new ways to commit crimes, including through automation. In this case, the use of AI to infiltrate “Binance”’s systems is plausible.
Chainalysis said the attacker used laundering patterns “we have not seen before”.
