Two major blockchain analytics firms say they have robust intelligence pointing to a North Korean state-backed group as the likely culprits behind the $6.3bn theft from Binance. The Lazarus Group — also known as TraderTraitor — was identified “with high confidence” by TRM Labs, and separately by Chainalysis.
In this heist, agents are accused of using a special authorisation to turn a Binance hot wallet — one connected to the internet — into a wallet that moved funds automatically to the attacker. TRM says it is likely the attacker reached Binance’s hot wallet signing system as part of the scheme. Binance has not directly responded to the BBC’s questions about links to North Korea.
Why two firms agreeing matters
Attribution in cyber-attacks is normally hedged for months, and for good reason: tooling gets copied, infrastructure gets rented, and false flags are cheap. Two commercial firms independently reaching “high confidence” within days is therefore the strongest signal available this early.
What they are reading is the money, not the malware. Blockchain analytics works by clustering addresses and matching laundering patterns — which exchanges are used, in what order, with what delays, through which mixers — against patterns seen in previous thefts. North Korean operations have a long enough history to have a recognisable signature.
The record behind the claim
Last year the FBI said North Korea was responsible for the theft of $1.5bn from the Bybit exchange, and named TraderTraitor specifically. The agency said the group moved quickly to launder and disperse the assets, converting them to Bitcoin and other tokens with the goal of eventually turning them into hard currency. North Korean hackers are also suspected in the theft of $620m of cryptocurrency in 2022.
The country’s most spectacular suspected intrusion was not financial: the 2014 attack on Sony Pictures, which had made The Interview, a film involving a plot to assassinate Kim Jong Un. That hack exposed thousands of embarrassing internal emails.
Why a state would do this at all
This is the part that makes the story more than a crime report. North Korea is one of the poorest countries in the world, internet access inside it is severely restricted, and it is subject to comprehensive sanctions. Experts accuse the government of relying on cybercrime to finance itself, which Pyongyang has long denied.
According to reports, the state has built its cyber capability deliberately, recruiting the most promising university students into hacker groups overseen by its intelligence agency, with some operations run from across the border in China. Seen that way, crypto theft is not opportunistic crime but a revenue line for a sanctioned state — and the reason it works is the property this industry advertises as a feature. Money that no institution can freeze is also money no institution can claw back.
Why attribution is published at all
Worth asking, because naming a state actor brings a company no obvious commercial benefit. The answer is that blockchain analytics firms sell exactly this: exchanges, banks and law-enforcement agencies pay for the ability to tell whether an incoming deposit is traceable to a sanctioned group.
That has a consequence most coverage misses. Once funds are publicly attributed to a sanctioned North Korean unit, every regulated exchange in the world is on notice — accepting them becomes a sanctions violation rather than a bad trade. Attribution is therefore not just a finding; it is the mechanism that makes the money harder to spend, which is the only lever anyone has left once the Bitcoin is moving.
