2026-10-31 19:36:20Kosova&Bota SHKRUAR NGA REDAKSIA VOX

Two major blockchain analytics firms say they have strong evidence that a North Korean state-backed hacker group may be behind the hack of Binance, the world's largest cryptocurrency exchange. The attack is believed to have resulted in the theft of $6.3 billion.

The Lazarus Group, a North Korean hacking unit also known as TraderTraitor, has been identified “with a high degree of confidence” by TRM Labs and Chainalysis.

The incident is just the latest in a series of cyberattacks attributed to Pyongyang. The country, one of the poorest in the world, has limited access to the internet, and experts accuse Kim Jong Un's government of relying on cybercrime to generate revenue. Pyongyang has long denied the allegations.

Last year, the US Federal Bureau of Investigation (FBI) stated that North Korea was responsible for the theft of $1.5 billion from the Bybit platform.

The country's alleged hackers have also been linked to the theft of $620 million in cryptocurrencies in 2022.

One of the most high-profile attacks allegedly carried out by North Korea occurred in 2014, when the film company Sony Pictures, which had produced the Hollywood film “The Interview,” was targeted. The film depicted a plot to assassinate Kim Jong Un. The attack exposed thousands of private emails of the company’s executives.

According to the FBI, the TraderTraitor group acted to quickly launder and distribute stolen assets, converting them into Bitcoin and other cryptocurrencies, with the intention of later converting them into regular money.

In the latest case, suspected North Korean agents are accused of using special authorization to alter the operation of a Binance wallet connected to the internet, causing funds to be automatically transferred to the attackers. TRM Labs estimates that the hackers may have gained access to the platform’s wallet signing system.

Binance initially stated that it suspected that an engineer's laptop had been compromised, which had enabled unauthorized withdrawals.

The company later said that the investigation had uncovered additional security breaches. Binance co-CEO Richard Teng confirmed that the investigation had uncovered additional breaches.

A Binance spokesperson said on Friday that about 80% of the stolen assets had been recovered, while the rest remained unaccounted for. The company did not directly respond to BBC questions about the attack's possible links to North Korea.

Experts say the country's cyber operations have been developed systematically, with the most talented university students being selected and directed towards hacking groups overseen by the intelligence agency.

Some of the cyber activity is also suspected to be taking place from Chinese territory, near the border with North Korea.

If the allegations are confirmed, the attack on Binance would demonstrate the growing power of suspected North Korean hackers.

Experts warn that the development of artificial intelligence could give malicious actors new tools to automate attacks and penetrate security systems.

In this case, the use of artificial intelligence to infiltrate Binance’s systems is considered possible. Chainalysis said the attackers used money laundering patterns that the company had not encountered before.


Video