Why North Korea's 'elite' hackers are the prime suspect in major Binance hack

Two prominent blockchain analytics companies have identified a North Korean state-sponsored group as the primary suspect in the recent $6.3 billion (£4.7 billion) hack of Binance, the largest cryptocurrency exchange globally. TRM Labs and Chainalysis both reported with high confidence that the Lazarus Group, also referred to as TraderTraitor, is behind the attack.

This breach is part of a series of cybercrimes linked to North Korea, a nation struggling economically and known for its stringent internet restrictions. Analysts have accused the regime led by Kim Jong Un of utilizing cybercrime as a means of financing its operations, a claim that Pyongyang has consistently denied.

One of the most notable hacks attributed to North Korea occurred in 2014 when Sony Pictures was targeted due to the release of the film "The Interview," which depicted an assassination attempt on Kim. This breach led to the exposure of numerous sensitive emails among the studio's executives.

Last year, the FBI attributed the theft of $1.5 billion from the Bybit exchange to North Korean hackers. Following that incident, the FBI reported that TraderTraitor quickly laundered and distributed the stolen funds, converting them into Bitcoin and other digital currencies in an effort to eventually exchange them for cash.

The FBI has broadly accused North Korea of engaging in illicit cyber activities and virtual asset theft. Reports suggest that the country has systematically enhanced its cyber capabilities by recruiting top students from universities and integrating them into hacking units under the supervision of its intelligence agency.

Some of these cyber operations reportedly occur just across the border in China, according to analyses from technology firms. The majority of North Korean hacking efforts appear to focus on financial gain. In 2022, hackers from North Korea were implicated in the theft of $620 million worth of cryptocurrencies.

In the recent Binance hack, North Korean agents are alleged to have exploited a special authorization that enabled them to convert a Binance hot wallet—an online wallet—into one that automatically redirected funds to the attackers. TRM Labs speculated that the assailant gained access to Binance’s hot wallet signing system as part of their strategy.

Although Binance has not directly addressed inquiries from the BBC regarding the potential connection to North Korea, the company initially suggested that a compromised engineer's laptop allowed unauthorized withdrawals. However, it later revealed that the breach was more extensive than initially believed. "Our subsequent investigation has uncovered additional points of breach," stated Binance co-CEO Richard Teng.

A spokesperson for Binance indicated that approximately 80% of the stolen assets have been secured, but the remainder remains missing. If the allegations are accurate, this unprecedented heist underscores the increasing capabilities of suspected North Korean hackers, highlighting the sophistication of their tools.

Experts have noted that advancements in artificial intelligence may provide threat actors with novel methods for executing cybercrimes, including automation. In this instance, it is conceivable that AI played a role in breaching Binance's defenses. Chainalysis remarked that the laundering patterns employed by the attacker were "unprecedented," further illustrating the evolving landscape of cyber threats.