North Korea's Lazarus Group has emerged as the leading suspect in a large-scale cryptocurrency attack on Binance that unfolded on October 29, in which roughly $6.3 billion in digital assets was taken — a haul that, if confirmed, would rank as the largest theft in crypto history.

Blockchain investigators identified similarities between the operation and previous campaigns attributed to North Korean hackers. Security researchers believe the sophisticated attack involved TraderTraitor, a hacking unit associated with Lazarus that U.S. agencies have previously flagged in joint advisories for targeting cryptocurrency businesses. United Nations experts have previously reported that stolen cryptocurrency has served as a significant revenue source for North Korea. Authorities have not officially confirmed the identities of those responsible, and investigations remain ongoing.

Blockchain Investigators Point to North Korean Hackers

Blockchain investigator ZachXBT identified Lazarus Group as the likely attacker behind the Binance security breach, as reported by CoinDesk. Separately, blockchain intelligence firm TRM Labs expressed high confidence that North Korea's TraderTraitor unit orchestrated the operation.

According to TRM Labs, attackers moved approximately $6.36 billion out of Binance wallets across 10 blockchain networks, with most transactions completed in roughly 20 minutes — a pace suggesting extensive preparation and coordinated execution. Researchers identified parallels with earlier North Korean cryptocurrency attacks, including suspicious wallet activity and advance transaction preparation, though investigators continue to examine the evidence before reaching a definitive conclusion.

Binance Identifies Possible Security Breach

Binance said the breach may have been enabled by a compromised laptop belonging to a DevOps engineer. The suspected intrusion allowed unauthorized access to a service container, which attackers allegedly used to initiate fraudulent withdrawal transactions — a detail that underscores why internal access controls at centralized exchanges remain a critical line of defense alongside on-chain safeguards.

The exchange emphasized that no evidence of leaked wallet private keys had been found. Binance also temporarily suspended deposits and withdrawals while strengthening security controls and investigating the incident.

According to the company's latest statement, approximately $3 billion in affected assets had already been frozen through cooperation with blockchain partners. Binance pledged to cover customer losses using its Secure Asset Fund for Users — an emergency reserve established in 2018 — and company resources.

Record Crypto Theft Raises Industry Concerns

The suspected Lazarus involvement follows several major cryptocurrency attacks previously attributed to North Korean hackers. In February 2025, attackers linked to the group stole approximately $1.5 billion from cryptocurrency exchange Bybit, and U.S. authorities have also tied the group to the 2022 theft of roughly $600 million from the Ronin Network bridge. The latest incident significantly exceeds that earlier record and highlights persistent vulnerabilities in centralized cryptocurrency infrastructure.

The breach also unsettled digital asset markets. Bitcoin dropped below $77,000 during the initial market reaction, while Ethereum and Binance-linked BNB recorded substantial declines.

Security experts expect the investigation to focus on how attackers gained access to Binance's transaction authorization systems. Meanwhile, efforts to trace and freeze the stolen cryptocurrency remain critical to limiting the financial damage. With proceeds dispersed across 10 networks, recovery will likely depend on continued coordination among exchanges, analytics firms, and law enforcement, and attention now turns to whether authorities issue formal attribution, whether more assets can be frozen, and when Binance fully restores deposit and withdrawal services.