An analysis by Chainalysis and TRM Labs attributes a historic $6.3 billion cryptocurrency heist at Binance to North Korea's Lazarus group.
Investigators report that attackers leveraged unauthorized hot wallet transaction authorizations following blockchain upgrades.
Who is under the microscope?
Two digital transaction monitoring firms, Chainalysis and TRM Labs, attribute the attack to the North Korean state-sponsored group TraderTraitor, also known as Lazarus. The same group has previously been blamed for major attacks on other exchanges, including the theft of $1,5 billion from Bybit and $387 million from Bitget.
Chainalysis has identified that the funds stolen from Binance are being transferred and mixed with accounts used in the Bitget attack. For its part, TRM Labs reports with a high degree of certainty that the attack is due to the same group, basing its conclusion on data from transaction analysis.
How did the attack happen?
TRM Labs believes the attackers managed to insert malicious code into Binance’s internal cryptocurrency wallet, which is used for customer withdrawals. The attackers also exploited a May 2025 change to the Ethereum system to automate transfers.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Hacker group used artificial intelligence in cyberattacks against more than 200 organizations
↗
Specifically, on Thursday afternoon, the attackers submitted a single transaction with dozens of authorizations signed by the Binance wallet. Within minutes, huge amounts of digital currencies, including Ethereum and billions of USDT, were transferred to addresses controlled by the attackers. TRM Labs estimates that the attackers were able to trick Binance’s system into approving transactions of their choosing, while Chainalysis reported that the unauthorized transfers amounted to approximately $6,4 billion.
Rinse and reaction
Immediately after the theft, the perpetrators used thousands of automated transactions in a short period of time to wipe out the money. However, Binance and other companies were able to quickly freeze some of the funds.
Binance announced that it has already frozen $3 billion and is working to recover the funds. The company has frozen over $6,34 billion of its own funds to cover the incident, with $5 billion held in the lost coins, while it is working with authorities and cryptocurrency issuers to seize the remaining frozen funds. Binance initially said that the attack may have been carried out via a compromised employee laptop, but later said that the ongoing investigation has uncovered other points of breach.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Top comments (0)