Two leading blockchain analytics firms, TRM Labs and Chainalysis, have identified the North Korean state-backed hacking unit, the Lazarus Group—also known as TraderTraitor—as the primary suspect in the staggering $6.3bn (£4.7bn) theft from Binance, the world’s largest cryptocurrency exchange. Both firms reported their findings with high confidence, citing robust intelligence linking the operation to Pyongyang.
This massive breach is the latest in a series of cyber activities attributed to the country, despite its status as one of the world’s poorest nations with strictly limited internet access. Experts allege that the government of Kim Jong Un increasingly relies on sophisticated cybercrime to generate state revenue, a claim that North Korean officials have consistently denied.
Historical precedents for North Korean-linked cyberattacks include the 2014 breach of Sony Pictures. While not a direct financial theft, that operation remains one of the most high-profile incidents involving the regime. It was launched following the production of the film The Interview, which centered on a plot to assassinate Kim, and resulted in the widespread leak of sensitive, confidential emails from studio executives. The nation’s most spectacular suspected hack took place in 2014, though not financial. The resulting hack exposed thousands of embarrassing emails exchanged among the studio’s top executives.
