Lazarus Group Named Likely Suspect in Reported $6.3bn Binance Hack

What changed

TRM Labs and Chainalysis have identified Lazarus Group, also known as TraderTraitor, with high confidence as the likely force behind the reported $6.3bn Binance hack. Binance says its investigation found additional breach points after initially blaming a compromised engineer’s laptop, and that 80% of the stolen assets have been secured; the rest remains unaccounted for.

The suspected attack reached Binance’s hot-wallet signing system, allowing funds to move automatically. Binance has not confirmed the North Korea attribution, and the final recovery total is still unknown.

Why it matters

This was not simply a stolen password and a missing pile of crypto. The suspected route ran through the machinery that authorises transfers, which puts the security of exchange controls under sharper scrutiny.

It also shows why Lazarus Group remains such a serious concern. The FBI previously attributed a $1.5bn theft from Bybit to North Korea, saying the stolen assets were rapidly converted and dispersed. Binance’s case suggests that suspected North Korean operators are continuing to target the systems behind crypto custody, not just individual wallets.

The practical question now is how much of the remaining money can be traced and recovered, and whether Binance’s additional breach points reveal a wider weakness in its signing process. Claims that artificial intelligence helped the attackers remain unverified, so the clearest lesson is about access and authorisation: once those controls fail, the size of the theft can grow very quickly.