Cybersecurity investigators and blockchain tracking firms have identified North Korean state-sponsored hackers as the primary suspects behind the $6.3 billion theft from cryptocurrency exchange Binance, the BBC and the New York Post reported.
The breach, which occurred Thursday, is regarded by industry specialists as the largest digital asset heist in history. Both TRM Labs and Chainalysis said they assessed with high confidence that the Lazarus Group, a North Korean cyber unit also known as TraderTraitor, carried out the operation. Binance halted customer withdrawals following the incident, stating it aims to restore access by Sunday afternoon pending security reviews, Gizmodo reported.
Tactics Aimed at Workers Rather Than Code
Investigators said the attackers likely bypassed network protections through social engineering rather than exploiting purely technical vulnerabilities. Lisa Zhao, security operation lead at cybersecurity firm SlowMist, told the New York Post that North Korean operatives frequently target staff members directly.
“They attack people, not code,” Zhao told the newspaper.
Zhao explained that in similar campaigns observed in 2025, attackers posed as project teams or prospective investors, offering developers paid work to review software or test trading programs. The malicious components were slipped into genuine public software projects. Once employees ran the modified code, hackers requested minor configuration adjustments that compromised digital safeguards and allowed the attackers to infiltrate internal networks. Zhao added that SlowMist tracked digital wallet addresses from the Binance heist back to earlier thefts attributed to North Korea, including a breach of the crypto exchange Phemex in early 2025.
SlowMist founder Yu Xuan noted that the regime often uses compromised computer systems in the United States, Europe and Japan as intermediaries to obscure origins. Xuan and a recent report from Microsoft also highlighted that North Korean groups increasingly deploy artificial intelligence tools to craft fake identities, draft deceptive recruitment material and generate malicious code at greater scale.
Binance Pledges to Cover Losses
Binance representatives said the company, working alongside industry partners including Tether, Circle, Ripple and World Liberty Financial, successfully froze roughly $3 billion of the stolen tokens, Gizmodo reported via Reuters. The fate of the remaining $3.3 billion remains unclear.
Binance leadership sought to quell fears of insolvency. Co-Chief Executive Officer Richard Teng said in a statement that customer assets remain secure and that the company will cover all losses with corporate reserves. Co-CEO Yi He stated on social media that the stolen amount represents approximately 2 percent of the exchange’s total assets and reserves, which stood above $160 billion in custody in 2024, according to BBC News.
The assurances have not fully eased skepticism across the crypto market. Legal analysts cautioned that pledges made on social media may not constitute binding guarantees, drawing comparisons to statements made by executives before the 2022 collapse of FTX. Others in the sector questioned whether smaller exchanges would receive the same rapid intervention from major stablecoin issuers to freeze stolen funds.
Federal authorities, including the FBI and the U.S. Secret Service, are investigating the incident alongside Binance. North Korea, which has faced severe international sanctions and previously denied involvement in cyberthefts, has long been accused by the U.S. Treasury Department of using state-directed hacking to fund its weapons programs.
