Updated Oct 30, 2026, 12:44 a.m. EDT. Published Oct 29, 2026, 11:36 p.m. EDT.
2 min read
Based on findings from multiple blockchain analysis firms and investigators, a North Korean cyber threat group appears accountable for lifting more than $6 billion in digital assets from Binance, the planet’s largest cryptocurrency exchange.
The Lazarus Group, sanctioned by North Korea, functions as a state-backed hacking collective that executes cyber intrusions to finance the isolated nation’s clandestine weapons development.
On X (formerly Twitter), blockchain analyst ZachXBT noted via a post that the perpetrator was “likely Lazarus.” Simultaneously, blockchain intelligence firm TRM released an article late Thursday indicating that TraderTraitor—a sub-division of Lazarus—was probably behind the exploit, expressing “high confidence” in their conclusion.
Similarly, Chainalysis CEO Jony Levin stated that his organization evaluated the breach as “likely done by DPRK group TraderTraitor,” pointing to connections with a previous attack.
In comments provided to CoinDesk, Blockaid co-founder and CEO Ido Ben-Natan explained that “the tactics and level of sophistication we’ve seen so far are consistent with the kinds of operations we’ve seen from DPRK.”
Ben-Natan added, “DPRK-linked actors have been tied to several of the major crypto hacks this year, including the Kelp DAO, Bitget and Drift incidents this year.”
A source close to cryptocurrency investigations informed CoinDesk that very few entities possess the capability to execute such an operation, while advising caution that the incident is not yet definitively pinned on Lazarus. They observed that Lazarus and other North Korean hacking cells typically transfer and liquidate stolen digital funds with greater speed and efficiency than the Binance attackers demonstrated on Thursday.
North Korea has faced accusations of involvement in nearly all major crypto exploits to date. As arguably the most prominent threat group operating within the digital asset sector, the Lazarus Group has orchestrated catastrophic breaches, such as the $1.46 billion theft from Dubai-based exchange Bybit during the previous year.
When it occurred in February 2025, that breach stood as the largest in history and constituted the vast majority of the $2.02 billion in cryptocurrency pilfered throughout that year. Furthermore, the Lazarus Group is suspected of masterminding other massive crypto attacks, such as the $292 million exploit targeting KelpDAO in April alongside the $625 million Ronin Network breach in 2022.
In an update released late Thursday, Binance reported that its investigation traced the initial intrusion point to a compromised laptop belonging to a DevOps engineer.
Read all of CoinDesk’s coverage of the Binance hack here.
UPDATE (Oct. 30, 04:44 UTC): Adds Chainalysis.
Originally published at https://www.coindesk.com/policy/2026/10/29/crypto-s-longtime-foe-north-korea-s-lazarus-group-likely-behind-binance-hack-blockchain-sleuths.
