Two leading blockchain analysis firms claim to have reliable intelligence indicating that a North Korean state-backed group is the likely perpetrator of the hack on Binance, the world's largest cryptocurrency exchange, in which $6.3bn (around £4.7bn) was stolen.
The Lazarus group, a North Korean hacking unit also known as TraderTraitor, was identified by TRM Labs and Chainalysis with "high confidence". Experts accuse the government of North Korean leader Kim Jong Un of relying on cybercrime to finance the state, which Pyongyang has long denied.
The country's most spectacular suspected hacking attack occurred in 2014, targeting Sony Pictures, the studio that produced the Hollywood film The Interview. The film includes a plot to assassinate Kim, and the subsequent hacking attack exposed thousands of uncomfortable emails exchanged among the studio's top executives.
Last year, the Federal Bureau of Investigation (FBI) stated that North Korea was responsible for the theft of $1.5bn on the Bybit exchange. Following that incident, the agency noted that TraderTraitor quickly began tracking and dispersing the stolen assets, converting them into bitcoin and other digital assets with the aim of eventually cashing them out. The FBI generally accused North Korea of "unauthorised cybercrime and virtual asset theft activities".
According to reports, the country has systematically developed its cyber operations, recruiting the most promising university students and directing them into hacking groups overseen by the North Korean intelligence agency. Part of the cyber warfare takes place directly across the border, in China, according to analysis by technology groups. A large portion of its hacking activity is aimed at financial gain, and North Korean hackers are also suspected of stealing cryptocurrencies worth $620m in 2022.
In this latest attack, North Korean agents are accused of using special authorisation to turn Binance's "hot wallet", which is connected to the internet, into one that automatically transfers funds to the attacker. TRM stated that the attacker likely gained access to Binance's hot wallet transaction signing system.
Binance did not directly respond to BBC inquiries about possible links between the incident and the region. The company initially claimed that a portable computer belonging to one engineer had been compromised, enabling unauthorised withdrawals, but later stated that the attack was wider. "Our subsequent investigation revealed additional breach points," said Binance co-chairman Richard Teng.
A Binance spokesperson stated on Friday that around 80 per cent of the stolen assets had been secured, while the remainder remains unaccounted for. Experts note that the rise of artificial intelligence has given attackers new ways to commit crime, through automation and other means. In this case, AI was likely used to infiltrate Binance's systems. As Chainalysis put it, the attacker used money laundering patterns "we have not seen before".
