North Korea’s Lazarus Group Suspected in Record $6.3 Billion Binance Hack
North Korea’s notorious Lazarus Group has emerged as the leading suspect behind a massive cryptocurrency attack on Binance. The October 29 breach involved approximately $6.3 billion in digital assets, potentially making it the largest crypto theft in history. Blockchain investigators identified similarities between the attack and previous operations linked to North Korean hackers.
Security researchers believe the sophisticated operation involved TraderTraitor, a hacking unit associated with Lazarus. However, authorities have not officially confirmed the attackers’ identities, and investigations remain ongoing.
Blockchain Investigators Point to North Korean Hackers
Blockchain investigator ZachXBT identified Lazarus Group as the likely attacker behind the Binance security breach. Meanwhile, blockchain intelligence firm TRM Labs expressed high confidence that North Korea’s TraderTraitor unit orchestrated the operation.
According to TRM Labs, attackers transferred approximately $6.36 billion from Binance wallets across 10 blockchain networks. Most transactions occurred within roughly 20 minutes, suggesting extensive preparation and coordinated execution.
Researchers identified similarities with previous North Korean cryptocurrency attacks, including suspicious wallet activity and advance transaction preparation. However, investigators continue examining the evidence before reaching a definitive conclusion.
Binance Identifies Possible Security Breach
Binance revealed that a compromised laptop belonging to a DevOps engineer may have enabled the attack. The suspected intrusion allowed unauthorized access to a service container, which attackers allegedly used to initiate fraudulent withdrawal transactions.
The exchange emphasized that investigators had found no evidence of leaked wallet private keys. Binance also temporarily suspended deposits and withdrawals while strengthening security controls and investigating the incident.
According to the company’s latest statement, approximately $3 billion in affected assets had already been frozen through cooperation with blockchain partners. Binance pledged to cover customer losses using its Secure Asset Fund for Users and company resources.
Record Crypto Theft Raises Industry Concerns
The suspected Lazarus involvement follows several major cryptocurrency attacks previously attributed to North Korean hackers. In February 2025, attackers linked to the group stole approximately $1.5 billion from cryptocurrency exchange Bybit.
The latest incident significantly exceeds that earlier record and highlights persistent vulnerabilities in centralized cryptocurrency infrastructure.
The breach also unsettled digital asset markets. Bitcoin dropped below $77,000 during the initial market reaction, while Ethereum and Binance-linked BNB also recorded substantial declines.
Security experts expect the investigation to focus on how attackers gained access to Binance’s transaction authorization systems. Meanwhile, efforts to trace and freeze stolen cryptocurrency remain critical to limiting the financial damage.
