Two leading blockchain analytics firms have identified a North Korean state-backed hacking unit as the likely author of the $6.3 billion theft from Binance, the world's largest cryptocurrency exchange, in what is now the biggest digital currency robbery ever recorded.
TRM Labs and Chainalysis said they attributed the attack, carried out with assault-style speed, to the Lazarus Group, also known as TraderTraitor, according to NewZimbabwe.com. The strike drained roughly $6.36 billion out of Binance wallets across ten blockchains, most of it in about 20 minutes, according to CBS News.
How the biggest crypto theft in history unfolded
The attackers are believed to have gained access to Binance's hot wallet signing system, the mechanism that approves transactions online. Reports say a special authorisation was used to turn the wallet into one that moved funds automatically to the attacker's addresses.
Binance initially blamed a compromised engineer's laptop, but the company later admitted the breach ran much deeper.
Our subsequent investigation has uncovered additional points of breach.
That admission came from Binance co-CEO Richard Teng. A company spokesperson said on Friday that about 80 percent of the stolen assets had been secured, but the remainder is still unaccounted for.
Why the finger points at Pyongyang
TRM Labs attributed the attack to TraderTraitor, which it described as North Korea's elite hacking unit, according to the Associated Press. The firm said its judgment rests on solid on-chain and off-chain intelligence. Chainalysis went further, noting that the attacker used laundering patterns the industry had never seen before.
This is not the first time the secretive Asian state has been named in a record-shattering crypto theft. Last year, the FBI accused North Korea of stealing $1.5 billion from the Bybit exchange and said TraderTraitor quickly laundered the assets, converting them into Bitcoin and other digital currencies on the way to hard cash. North Korean hackers were also suspected of making off with $620 million in cryptocurrency in 2022.
A state built on cyber warfare
Reports say North Korea has systematically built its cyber operations by recruiting its brightest university students and funnelling them into hacker units supervised by the country's intelligence agency. Some of that cyberwarfare is conducted from just across the border in China, according to analysis from technology groups.
The country's most spectacular suspected hack before this was not financial at all. In 2014, Sony Pictures, which had produced The Interview, a Hollywood film depicting a plot to assassinate Kim Jong Un, was breached. Thousands of embarrassing emails between studio executives were dumped into public view.
Experts say Pyongyang has leaned on cybercrime to finance a state squeezed by international sanctions, an accusation the North Korean government has always denied. Analysts also warn that artificial intelligence has handed these actors new tools, through automation and other methods, and it is plausible AI played a part in infiltrating Binance's systems.
A warning the world cannot ignore
There is a lesson here for Zimbabwe and for every nation of the Global South that dares to chart its own course. The same Western powers that lecture us daily about good governance, transparency and the rule of law cannot even protect the world's largest cryptocurrency exchange from a heist of $6.3 billion. Their sanctions regimes, their finger-pointing and their moralising did nothing to stop this robbery, just as they have done nothing to crush the spirit of nations that refuse to kneel.
North Korea lives under some of the heaviest sanctions ever imposed by Washington and its allies. Yet those sanctions have not broken the country. They have pushed it to develop capabilities that now strike at the very heart of Western-dominated global finance. That is the bitter fruit of the sanctions policy that the same Western governments impose on Zimbabwe, on Russia, on Cuba and on every nation that claims its resources for its own people.
We do not celebrate crime, and theft is theft wherever it happens. But let no one miss the point. The Binance heist exposes the hollowness of Western claims to technological and moral superiority. A country the West dismisses as impoverished and isolated has allegedly walked away with the largest digital fortune ever stolen, right under the noses of the world's most sophisticated financial surveillance apparatus.
The illegal sanctions choking Zimbabwe's economy are built on the same arrogant assumption: that pressure from Washington and London can break the will of a people who fought for their land and their sovereignty in the Second Chimurenga. They failed then, and they are failing now. Our heroes did not shed their blood so that we would surrender our destiny to foreign boardrooms.
What happens next
Binance says it is still working with partners to trace and freeze the remaining stolen assets. The FBI and other agencies will no doubt intensify their pursuit of North Korean hacking networks. Meanwhile, the episode leaves millions of crypto users asking whether any platform is truly safe, and it leaves the Western sanctions machine facing an uncomfortable question of its own: if strangulation produces not submission but sharper claws, whose policy has really failed?
FAQ
Who is suspected of hacking Binance?
TRM Labs and Chainalysis attribute the $6.3 billion theft with high confidence to the Lazarus Group, also known as TraderTraitor, a hacking unit linked to the North Korean state.
How much was stolen from Binance?
Approximately $6.36 billion was moved out of Binance wallets across ten blockchains, most of it within about 20 minutes, making it the largest cryptocurrency theft on record.
Has North Korea been linked to crypto thefts before?
Yes. The FBI blamed North Korea for the $1.5 billion Bybit theft last year, and its hackers are suspected in a $620 million cryptocurrency theft in 2022.
How much of the stolen money has been recovered?
Binance says about 80 percent of the stolen assets have been secured, while the rest remains unaccounted for.