Binance Hack Pinned on North Korea’s Lazarus Group by TRM Labs and ZachXBT

Investigators Point to Pyongyang

The hunt for the Binance attacker has a premier fishy now, with blockchain analytics steadfast TRM Labs attributing the onslaught to Tradertraitor (part of the Lazarus ecosystem), which it called North Korea’s elite hacking unit. The steadfast reached that judgement with precocious assurance based connected onchain and offchain intelligence, valuing the haul astatine astir $6.36 cardinal astatine the clip each plus was taken.

Independent researcher ZachXBT reached a akin conclusion hours earlier, and erstwhile asked who was down the drain, helium replied:

“It’s apt the Lazarus Group (DPRK)”

That said, the posts do not automatically corroborate responsibility, and nary authorities has formally named a culprit yet.

Ari Redbord, TRM’s planetary caput of policy, told Al Jazeera the onslaught is unprecedented and volition subsequently beryllium looked astatine arsenic a watershed infinitesimal successful the past of crypto, adding:

“When North Korea steals astatine this scale, the wealth funds weapons proliferation and different destabilising activity.”

A Known Playbook but Four Times Bigger

TRM’s squad believes that the staging and signature patterns match the Bybit theft from aboriginal past year, which the FBI pinned connected the aforesaid group, on with the Kelpdao hack successful April 2026. Blockchain analytics steadfast Chainalysis separately estimated astir $5.912 cardinal was stolen, astir 4 times the size of Bybit.

The mentation was methodical, with onchain researcher 0xQuit uncovering the attacker’s relayer was funded by 3 Tornade Cash withdrawals of 0.1 ETH each implicit the anterior 2 days, with a delegate declaration deployed astatine 15:59 UTC. Another expert said the attacker rehearsed the drain six hours earlier connected 3 caller wallets, sweeping trial amounts of aggregate tokens.

The unrecorded onslaught came astatine 20:24 UTC, erstwhile 167,464 ETH moved out of the Binance 14 blistery wallet. Bitcoin.com News elaborate yesterday however the wallet-delegation maneuver worked as good arsenic however Binance’s ain initial findings pointed to a compromised DevOps engineer’s laptop.

Social media added a mocking twist to the full episode, with 1 commentator claiming that the attacker launched a “LAZARUS” meme coin connected Pump.fun. Bitcoin.com News could not verify that the deployer is linked to the hacker’s wallets.

Where the Money Is Going

Unlike Bybit, wherever stolen funds raced crossed bridges, this laundering has leaned connected ample trades. TRM said the attacker sold astir 325 cardinal USDT to marketplace makers for astir 122,300 ETH astatine a discount of much than 10%. It besides borrowed astir 19,760 ETH connected Aave against 60 cardinal USDT.

Freezes person clawed backmost a ample stock and Binance said the full magnitude frozen has reached astir $3 billion. Still, TRM estimates the attacker holds much than 420,000 ETH and 18,270 BTC, astir $2.4 cardinal beyond issuers’ reach, with the bitcoin moving done a peel chain, a laundering method that splits funds into a agelong drawstring of smaller transfers.

Onchain Lens reported the radical was moving implicit $1 cardinal successful ETH to caller wallets, apt up of mixing. TRM expects the adjacent signifier to impact cross-chain bridges, swap services, and over-the-counter (OTC) brokers.

A Record Year for Crypto Theft

The heist lands successful what Defillama calls the astir hacked year successful crypto history, with implicit $8 cardinal stolen truthful acold successful 2026. By comparison, cybercriminals stole $2.87 cardinal crossed astir 150 incidents successful 2025.

The Binance deed besides came hours aft Polymarket halted trading over a abstracted exploit, showing however galore fronts information teams are warring connected astatine once.

The Aftermath Could Be Unparalleled

TRM said it is alerting partners done its Beacon Network and urged exchanges to surface deposits against labeled attacker addresses. At the aforesaid time, Binance has promised a elaborate method post-mortem erstwhile its preliminary probe is complete.

The cardinal question present is speed, since each hr the attacker’s ETH and BTC beryllium unmixed gives investigators much clip to emblem exits, portion North Korea’s way grounds suggests the radical volition effort to currency retired done OTC desks earlier the way goes cold.