Two leading blockchain analytics firms, TRM Labs and Chainalysis, have identified the North Korean state-backed hacking group Lazarus, also known as TraderTraitor, as the likely culprits behind the massive $6.3bn (£4.7bn) hack of Binance, the world's largest cryptocurrency exchange. This incident adds to a growing list of cybercrimes linked to North Korea, a country known for its restricted internet access and economic struggles. Experts believe the North Korean government relies on cybercrime to finance itself, a claim Pyongyang has consistently denied.
The Lazarus Group has been accused of similar heists in the past, including a $1.5bn theft from the Bybit exchange last year. The FBI has broadly accused North Korea of engaging in 'illicit cybercrime and virtual asset theft activities.' The nation has systematically developed its cyber operations, recruiting top students from universities and channeling them into hacker groups overseen by North Korea's intelligence agency.
In the recent Binance hack, North Korean agents are accused of using a special authorization to turn a Binance hot wallet into one that moved funds automatically to the attacker. TRM Labs suggests the attacker gained access to Binance's hot wallet signing system. Binance initially thought an engineer's laptop had been compromised but later revealed the attack was wider. As of Friday, 80% of the stolen assets have been secured, but the rest remains unaccounted for.
The rise of artificial intelligence has given threat actors new ways to carry out crime, through automation and other means. In this case, it's plausible that AI was used to infiltrate Binance's systems. Chainalysis noted that the attacker used laundering patterns 'we have not seen before,' highlighting the evolving tactics of cybercriminals.