Two major blockchain analytics firms say they have robust intelligence pointing to a North Korean state-backed group as the likely culprits in the $6.3bn (£4.7bn) hack of Binance, the world's largest cryptocurrency exchange. The Lazarus Group, a North Korean hacking unit also known as TraderTraitor, was identified "with high confidence" by TRM Labs, as well as Chainalysis. This incident is just the latest linked to the country, one of the poorest in the world and where access to the internet is severely restricted.
Experts accuse the government of North Korean leader Kim Jong Un of relying on cybercrime to finance itself, something Pyongyang has long denied. Though not financial, the nation's most spectacular suspected hack took place in 2014. The target: Sony Pictures, which had made the Hollywood film The Interview.
The film involves a plot to assassinate Kim. The resulting hack exposed thousands of embarrassing emails exchanged among the studio's top executives. Who could be behind the Binance hack and what we know so far Crypto giant Binance attempting to recover $6.3bn stolen in hack linked to North Korea Last year, the Federal Bureau of Investigation (FBI) said North Korea was responsible for the theft of $1.5bn on the Bybit exchange.
In the aftermath of that incident, the agency said TraderTraitor had moved to quickly launder and disperse the stolen assets, converting them to Bitcoin and other digital assets with a goal of eventually turning them into hard currency. The FBI has broadly accused North Korea of "illicit cybercrime and virtual asset theft activities". The nation has systematically developed its cyber operations, recruiting the most promising students from universities and channeling them into hacker groups overseen by North Korea's intelligence agency, according to reports.
Some of the cyberwarfare conducted takes place just over the nation's border in China, according to analysis from tech groups. Much of its hacking activity has centred on monetary gain. North Korean hackers are also suspected in the theft of $620m worth of cryptocurrency in 2022.
In this most recent heist, North Korean agents are accused of using a special authorisation to turn a Binance hot wallet, which is connected to the internet, into one that moved funds automatically to the attacker. TRM said it's likely the attacker gained access to Binance's hot wallet signing system as part of the scheme. Binance has not directly responded to the BBC's queries about the incident's potential links to the area.
Extract — continue reading at the source.
