For most of the world the Binance hack is a story about cryptocurrency. For Bangladesh it is something closer to home, because of the name attached to it.
Two blockchain analytics firms, TRM Labs and Chainalysis, identified the North Korean cyber unit known as the Lazarus Group — or TraderTraitor — as the party behind the theft of $6.3bn from the exchange. The FBI has since said the same.
That is the name the FBI attached to the raid on this country’s central bank.
February 2016
According to the FBI’s investigation, the theft from Bangladesh Bank’s reserves in February 2016 was the work of the Lazarus Group. The operation exploited weaknesses in the security arrangements around SWIFT, the messaging network banks use to instruct payments between one another.
The same actor has been linked to the 2014 attack on Sony Pictures, which leaked thousands of executives’ emails, and to the $1.5bn theft from the Bybit exchange, which the FBI also attributed to North Korea.
What changed between the two
The difference between 2016 and 2026 is not the attacker. It is what the attacker now goes after.
The Bangladesh Bank operation attacked instructions — fraudulent payment messages moving real money between real banks, a system with correspondents, intermediaries and people who can be telephoned. Some of that theft was stopped mid-flight, and a share of it was eventually recovered, precisely because the plumbing had humans in it.
The Binance operation attacked a wallet. According to the account carried by Prothom Alo, North Korean agents used a particular authorisation to move funds automatically out of an internet-connected hot wallet and into accounts they controlled. There is no correspondent bank to call at two in the morning.
Where the money goes
The FBI’s account of TraderTraitor is that the group moves quickly to convert stolen funds into bitcoin and other digital assets and then into usable cash. North Korea is understood to select capable students out of its universities and build hacking units under its intelligence services; those units are reported to have taken more than $620m in cryptocurrency over recent years before this month.
Binance co-chief executive Richard Teng said a deeper investigation had revealed several points of unauthorised access, and that around 80% of the stolen assets had been recovered or secured, with the rest still missing. Chainalysis said the attackers used money-laundering patterns that had not been seen before, and specialists think artificial intelligence may have been used in the operation.
For readers here, the useful point is not the size of the number. It is that a unit which once needed a bank’s messaging system and a set of forged instructions now needs one compromised laptop and an authorisation.
What was learned here, and whether it transfers
Bangladesh spent years on the consequences of 2016 — the recovery litigation, the arguments about who was liable, the tightening of controls around SWIFT access. Much of that work was about a specific weakness in a specific messaging system, and it did make that particular route harder.
What the Binance case shows is that the route was never the point. The same organisation moved to a different kind of target with different plumbing, and the defensive work done on interbank messaging does nothing there.
The transferable lesson from 2016 is narrower and duller than the technical one. It is that the gap between a theft and anyone noticing is where recovery happens, and that the institutions which got money back were the ones that could reach a human being on the other side quickly. That advantage shrinks as the plumbing becomes automatic.
