Binance, the world’s largest cryptocurrency exchange, reported the theft of digital assets valued at $6.3 billion. The incident is suspected to be the work of Lazarus, an umbrella network of elite hacking teams unofficially associated with North Korea and repeatedly linked to major cryptocurrency thefts.
Preliminary findings indicate that attackers compromised the laptop of a Binance engineer and used the employee’s credentials to access the exchange’s systems and withdraw funds without immediate detection. The full details remain unclear, as forensic investigations into sophisticated cyberattacks can take weeks, months or even years.
Nick Carlsen, an analyst at TRM Labs, told The Wall Street Journal that the attack was “without a doubt” the work of North Korea. Pyongyang has denied involvement in cryptocurrency exchange hacks in the past, while the nature of cyber operations makes it difficult to conclusively establish responsibility. Lazarus-linked teams also operate unofficially and may not be physically located in North Korea.
The group’s previous major cryptocurrency thefts show a similar pattern. In April of the previous year, attackers stole $1.5 billion from the Bybit exchange after compromising a computer belonging to a software developer at a digital-wallet provider. Malicious code remained hidden until a transaction was made, allowing the funds to be redirected to Lazarus-controlled wallets and traces to be erased in under two minutes.
Cryptocurrencies are attractive targets because their conversion into dollars or euros can be difficult to trace. Their combination of anonymity and rapid liquidity makes them useful for illicit operations. According to Chainalysis, Lazarus-linked activity resulted in the theft of $1.34 billion in cryptocurrency across 47 incidents in 2024, compared with $660 million across 20 operations in 2023.
The reported Binance theft would exceed the group’s previous records, including the Bybit incident and the $625 million in ether stolen in 2022 from a website connected to the video game Axie Infinity. Axios reported that the attackers may have been prevented from converting $3 billion of the Binance haul into conventional currency. The reported $6.3 billion total is equivalent to a substantial share of North Korea’s estimated gross domestic product of $17 billion, according to United Nations statistics.
Lazarus is also associated with espionage and sabotage operations. The United States, the United Kingdom and Microsoft have attributed the 2017 WannaCry 2.0 ransomware attack to North Korean hacking groups. The malware affected an estimated 300,000 computers in 150 countries, including systems used by the United Kingdom’s health service.
North Korean groups were also active in 2020, when they attempted to access computers belonging to workers at AstraZeneca and sought information from Pfizer as pharmaceutical companies worked on COVID-19 vaccines. The reported activity illustrated the wider range of operations attributed to the country’s hacking teams, which extends beyond cryptocurrency theft to espionage and disruption.
The Lazarus network is described as an advanced persistent threat with specialized teams, defined roles and significant resources. Its reported toolkit includes artificial intelligence, deepfakes and, more recently, post-quantum encryption intended to withstand potential attacks from quantum computers. These capabilities have helped make the group one of the most prominent names in international cybercrime and cyberespionage.
Sources: El País Tecnología.