North Korea's Lazarus Group Pocketed $6.3 Billion from Binance. Good Luck Getting It Back.
The FBI has formally attributed the record-breaking Binance crypto theft to North Korea's Lazarus Group, specifically its TraderTraitor unit, which has quietly become one of the most prolific financial crime operations on the planet.
The attack hit on October 29. Within about 20 minutes, according to blockchain intelligence firm TRM Labs, attackers had siphoned off $6.36 billion. Elliptic puts the figure slightly higher at $6.43 billion, and says it has confirmed that $2.85 billion of those assets have since been frozen or seized. The FBI published its official attribution on Saturday, alongside a list of wallet addresses tied to the theft, with a request that exchanges and crypto analytics firms block any transactions involving the stolen funds.
North Korea was already the prime suspect before the FBI said anything. Both TRM Labs and Elliptic had pointed the finger at Pyongyang days earlier.
As for how the attackers got in: Binance says a DevOps engineer's laptop was compromised, which gave the intruders a foothold in a service container and, ultimately, the ability to authorise withdrawals they had absolutely no right to make. Not exactly a sophisticated social engineering campaign, but effective enough.
Binance suspended customer withdrawals immediately after the attack and has since resumed them. The exchange claims it has covered around 95 percent of the stolen assets from its own reserves and emergency funds. Co-CEO Richard Teng has been explicit that customers won't be taking the hit. The remaining tokens are trickier to replace simply because of thin liquidity in those particular assets.
The reassurances haven't been entirely convincing. Binance saw roughly $3.64 billion in net outflows once withdrawals reopened. The company was quick to point out that this represents only about 2.1 percent of its total reported assets, which is technically true, but also the sort of framing you reach for when you're trying to make a large number sound small.
Meanwhile, the FBI says the hackers have begun converting stolen assets into Ethereum and are expected to push funds through decentralised finance platforms and instant swap services to make tracing harder. This is textbook Lazarus behaviour. The group has run this playbook before, most recently with the $308 million raid on Japan's DMM Bitcoin exchange in 2024. They also have a history of using fake job offers to trick exchange employees into compromising their own employers' systems.
And it isn't just Binance. Crypto exchange Bitget has confirmed that a separate attack draining $387.5 million from its wallets also bears the hallmarks of a North Korean operation. Bitget's CEO cited IP behavioural patterns and on-chain signatures as the basis for that assessment, without getting into specifics.
This is also not Binance's first rodeo with expensive security failures. Back in 2022, attackers exploited a vulnerability in the BNB blockchain bridge and walked away with around $566 million.
Binance can apparently absorb a loss of this scale. The bigger problem is that North Korea can't be sanctioned into returning the money, and the attackers still have billions of dollars sitting somewhere in the cryptocurrency ecosystem, waiting to be laundered. Tracking that is a different challenge entirely.