Why North Korea's 'elite' hackers are the prime suspect in major Binance hack
If the accusations are true, the record-making heist shows how powerful suspected North Korean hackers have become.
Why North Korea's 'elite' hackers are the prime suspect in major Binance hack
Two leading blockchain analytics companies say they have strong intelligence indicating a North Korean state-backed group is the likely culprit behind the $6.3bn (£4.7bn) hack of Binance, the world's largest cryptocurrency exchange.
TRM Labs, along with Chainalysis, identified the Lazarus Group, a North Korean hacking unit also called TraderTraitor, "with high confidence."
The case is only the latest to be tied to the country, one of the poorest in the world and a place where internet access is tightly restricted.
Experts accuse the government of North Korean leader Kim Jong Un of using cybercrime to fund itself, an allegation Pyongyang has repeatedly denied.
Although it was not a financial attack, the country's most dramatic suspected hack happened in 2014. The target was Sony Pictures, which had produced the Hollywood film The Interview. The movie centers on a plot to assassinate Kim.
The hack that followed leaked thousands of embarrassing emails between the studio's senior executives.
Last year, the Federal Bureau of Investigation (FBI) said North Korea was behind the theft of $1.5bn on the Bybit exchange.
After that incident, the agency said TraderTraitor had quickly moved to launder and spread the stolen funds, converting them into Bitcoin and other digital assets with the aim of eventually turning them into hard currency.
The FBI has broadly accused North Korea of "illicit cybercrime and virtual asset theft activities".
According to reports, the country has deliberately built up its cyber capabilities, selecting the most promising university students and directing them into hacker groups run by North Korea's intelligence agency.
Tech group analysis suggests some of the cyberwarfare takes place just across the border in China.
A large share of its hacking has focused on financial gain.
North Korean hackers are also believed to have stolen $620m worth of cryptocurrency in 2022.
In this latest theft, North Korean agents are accused of using a special authorisation to convert a Binance hot wallet, which is connected to the internet, into one that automatically transferred funds to the attacker.
TRM said the attacker likely obtained access to Binance's hot wallet signing system as part of the operation.
Binance has not directly answered the BBC's questions about possible links to the region.
The company first said it believed an engineer's laptop had been compromised, enabling unauthorised withdrawals, but later said the attack was broader.
"Our subsequent investigation has uncovered additional points of breach," Binance co-CEO Richard Teng said.
A Binance spokesperson said on Friday that about 80% of the stolen assets have been secured, while the remainder is still missing.
If the allegations are correct, the record-setting heist highlights how formidable suspected North Korean hackers have become, and how much sharper hacking tools have grown.
Experts also say the rise of artificial intelligence has given threat actors new ways to commit crime through automation and other methods.
In this case, it is possible that AI was used to break into Binance's systems.
As Chainalysis said, the attacker used laundering patterns "we have not seen before".