Record $6.3 Billion Binance Crypto Hack Highlights the Persistent Threat of North Korean Hackers

Binance has not yet confirmed it as of this writing, but US government agencies and independent cybersecurity firms have come to the conclusion that state-backed North Korean hackers are behind the $6.3 billion Binance crypto hack.

Even with some expected claw-back of funds, the incident is poised to shatter records for crypto theft; more importantly, it serves as a reminder that these state-backed teams are a persistent and highly advanced threat that are not going away any time soon.

CIA, FBI confident that North Korean hackers ripped off Binance

The official confirmation from Binance seems to be merely a formality at this point, with US intelligence and law enforcement agencies all pointing the finger at North Korean hackers. They are joined in this by major independent cybersecurity firms and blockchain analysis outfits such as Chainalysis, Elliptic, and TRM Labs.

An unsurprising development, given that the North Korean government has turned to these state-sponsored groups as a major source of funding for nearly a decade now. Their crypto hack theft total dating back to 2017 was at about $6.5 billion prior to this incident; it remains to be seen how much they’ll ultimately get away with here, as about $3 billion in stablecoins has been successfully frozen, but the total will likely be equal to a great deal of all of their prior work combined.

The specific group they’ve named is “TraderTraitor,” usually more commonly referred to as “Lazarus.” This particular group has been in action since at least 2009 and making major splashes on the international stage since the raid on Sony and massive leak of their internal materials in 2014. After proving itself over a decade ago this group seems to have taken point on illicitly obtaining funding for the North Korean government, targeting both more traditional banks and a broad assortment of crypto exchanges with creative schemes.

Crypto hacks no longer limited by cultural or language barriers

For those keeping track at home, the prior crypto hack record (also held by North Korean hackers) is $1.5 billion stolen from Bybit early last year. This one will likely be at somewhere above $3 billion in actual loss when all is said and done, with everything but the stablecoins observed to be converted to Ethereum and on its way to mixing and concealment services. Binance says it has covered 95% of the lost funds thus far and expects 100% coverage soon, but there was an expected exodus of over $4 billion from the platform after the news broke.

Any organization dealing in finance must obviously be wary of North Korean hackers on the prowl. But what lessons can other organizations take from this? Though Binance is continuing its internal investigation, it has indicated that a DevOps engineer’s laptop was the initial entry point of the breach. However, it cautions that this was a “complex” operation involving more steps than simply abusing one engineer’s stolen credentials. It nevertheless raises some questions about at what point a separate human validation should have kicked in before allowing essentially unlimited money to be swapped out of platform accounts.

It also provides some detail on the capability of the North Korean hackers – about 20 minutes to exfiltrate the funds, though the attackers were likely inside the system at least 36 hours prior preparing bogus signatures for validation. Still, that is a very short time in which to steal $6.3 billion.

It is also a reminder that the North Korean hackers are extremely sophisticated social engineers, not limited by language or culture. Since at least the Ronin Bridge attack in 2022, they have been known to set up fake job interviews with video conferencing (and this was well before AI use in that way was a possibility). The Drift breach that took place earlier this year was thought to be set up by several months of them visiting crypto conferences in-person around the world to groom prospective targets. While they are a unique case, AI is bringing their level of capability closer to the hands of more mundane criminal groups.