Two major blockchain analytics firms, TRM Labs and Chainalysis, have identified a North Korean state-backed group as the likely culprits in the $6.3bn hack of Binance, the world's largest cryptocurrency exchange. The Lazarus Group, a North Korean hacking unit also known as TraderTraitor, was identified "with high confidence" by both firms. This incident is the latest in a series of high-profile hacks linked to North Korea.
North Korea has been accused of relying on cybercrime to finance itself, with experts pointing to the country's restricted access to the internet and limited economic resources. The government of North Korean leader Kim Jong Un has long denied these allegations. In 2014, North Korean hackers were suspected in the high-profile hack of Sony Pictures, which had made the Hollywood film The Interview, a movie that involves a plot to assassinate Kim.
The FBI has broadly accused North Korea of "illicit cybercrime and virtual asset theft activities". Last year, the agency said TraderTraitor was responsible for the theft of $1.5bn on the Bybit exchange. The hackers used a similar tactic to launder and disperse the stolen assets, converting them to Bitcoin and other digital assets with a goal of eventually turning them into hard currency.
North Korean hackers are also suspected in the theft of $620m worth of cryptocurrency in 2022. The nation's cyber operations are systematically developed, with the most promising students from universities channeled into hacker groups overseen by North Korea's intelligence agency. Some of the cyberwarfare conducted takes place just over the nation's border in China.
In the Binance hack, North Korean agents are accused of using a special authorization to turn a Binance hot wallet into one that moved funds automatically to the attacker. TRM said it's likely the attacker gained access to Binance's hot wallet signing system as part of the scheme. Binance has not directly responded to queries about the incident's potential links to North Korea.
Binance initially said it thought an engineer's laptop had been compromised, allowing unauthorized withdrawals, but later said the attack was wider. "Our subsequent investigation has uncovered additional points of breach," Binance's co-CEO Richard Teng said. A Binance spokesperson said on Friday that some 80% of stolen assets have been secured, but the rest remains unaccounted for.
The record-making heist shows how powerful suspected North Korean hackers have become. Experts say the rise of artificial intelligence has given threat actors new ways to carry out crime, through automation and other means. Chainalysis noted that the attacker used laundering patterns "we have not seen before". The incident highlights the growing threat of North Korean cybercrime and the need for increased security measures.
Key points
- North Korean hackers likely behind $6.3bn Binance hack
- Hackers used sophisticated tactics, including AI, to carry out the crime
- Incident highlights growing threat of North Korean cybercrime
