CoinDesk
Blockchain investigators say North Korea's Lazarus Group was likely behind a theft of more than $6 billion in crypto assets from Binance, the world's largest crypto exchange. Binance traced the attack vector to a compromised DevOps engineer's laptop, while researchers cautioned that the attribution is not yet definitive.
Why it matters
TRM Labs assessed with high confidence that TraderTraitor, a North Korean group described as a Lazarus subunit, was likely responsible. Investigator ZachXBT also pointed to Lazarus. Blockaid CEO Ido Ben-Natan said the tactics and sophistication matched operations associated with DPRK-linked actors.
The scale would place the incident among crypto's largest reported hacks. Lazarus has been linked to the $1.46 billion Bybit hack in 2025, the $292 million KelpDAO exploit and the $625 million Ronin Network hack in 2022. North Korean-linked thefts have drawn scrutiny because stolen crypto can help fund the country's illicit weapons program.
Market impact
The attribution is still an assessment, not a confirmed finding. One investigator familiar with crypto cases noted that Lazarus-linked groups have often moved and sold stolen funds faster than the Binance attackers had on Thursday, a difference that may shape further analysis.
For Binance and the wider industry, the reported entry point makes internal security a central issue: investigators say the attack vector involved an engineer's compromised laptop. The investigation's next key signals are firmer attribution and evidence of how the stolen assets move.
Frequently asked questions
-
How did Binance trace the attack vector?
Binance said it traced the attack vector to a compromised DevOps engineer's laptop.
-
Who do investigators believe was behind the Binance hack?
Investigators say North Korea's Lazarus Group was likely responsible. TRM Labs assessed with high confidence that TraderTraitor, described as a Lazarus subunit, was involved.
-
Has responsibility for the hack been confirmed?
No. The attribution remains an assessment, and investigators cautioned that it is not definitive.
-
What previous crypto attacks have been linked to Lazarus?
Lazarus has been linked to the $1.46 billion Bybit hack in 2025, the $292 million KelpDAO exploit and the $625 million Ronin Network hack in 2022.
-
What evidence may investigators watch next?
Firmer attribution and evidence showing how the stolen assets move are key signals in the ongoing investigation.
WatcherGuru
CryptoSlate
Crypto Capital Venture
Lookonchain
TheBlock
WuBlockchain