conv.

All stories
SecurityQuiet 9d · day 13

North Korean hackers steal $2bn from Binance in largest crypto exchange breach

Blockchain security firms attribute Thursday's attack to Lazarus Group-linked TraderTraitor unit operating from abroad.

newest coverage 8d agosummary written 12d ago9 pieces53 likes & upvotes9 comments NewswiresBlueskyGoogle NewsHacker News

What to know

  • At least $2 billion was stolen from Binance on Thursday through a compromised engineer's laptop—assessed as the largest cyber attack on a crypto exchange.
  • Three blockchain security firms independently attributed the breach to North Korea's TraderTraitor unit, linked to the Lazarus Group, based on on-chain and off-chain intelligence.
  • North Korea has shifted from disruptive cyber attacks toward financial theft specifically to fund its nuclear weapons program.
  • Pyongyang's hackers operate from abroad—chiefly China, Russia, and Southeast Asia—to access better infrastructure and obscure their origin, while converting stolen crypto into usable currency.

“Being stationed abroad also makes it easier for the North Korean hackers to work with foreign financial networks to convert stolen cryptocurrency into conventional money.”

Security experts, Analysts · The Independent ↗

Lazarus Group / TraderTraitor North Korean state-sponsored hacking unitTRM Labs Blockchain intelligence firmChainalysis Blockchain security firmZachXBT Blockchain intelligence analystKim Jong UnKim Jong Un North Korean leader

North Korean hackers steal $2bn from Binance in largest crypto exchange breach
the-independent.com

How it unfolded 1 development · click the chart to see its coverage articles

Peak 2 pieces in 3h at Oct 30, 12 AM; 9 pieces over 13 days (7 articles · 2 posts) Oct 30, 12 AM — 2 pieces · 2 articles — Newswires 2Oct 30, 3 AM — quietOct 30, 6 AM — 2 pieces · 1 article · 1 post — Bluesky 1, Newswires 1Oct 30, 9 AM — 1 piece · 1 article — Google News 1Oct 30, 12 PM — 1 piece · 1 post — Hacker News 1Oct 30, 3 PM — quietOct 30, 6 PM — quietOct 30, 9 PM — quietOct 31, 12 AM — quietOct 31, 3 AM — quietOct 31, 6 AM — quietOct 31, 9 AM — quietOct 31, 12 PM — quietOct 31, 3 PM — quietOct 31, 6 PM — quietOct 31, 9 PM — quietNov 1, 12 AM — quietNov 1, 2 AM — quietNov 1, 5 AM — quietNov 1, 8 AM — quietNov 1, 11 AM — quietNov 1, 2 PM — quietNov 1, 5 PM — quietNov 1, 8 PM — quietNov 1, 11 PM — quietNov 2, 2 AM — quietNov 2, 5 AM — quietNov 2, 8 AM — quietNov 2, 11 AM — quietNov 2, 2 PM — quietNov 2, 5 PM — quietNov 2, 8 PM — 1 piece · 1 article — Google News 1Nov 2, 11 PM — 1 piece · 1 article — Google News 1Nov 3, 2 AM — quietNov 3, 5 AM — quietNov 3, 8 AM — quietNov 3, 11 AM — quietNov 3, 2 PM — quietNov 3, 5 PM — quietNov 3, 8 PM — quietNov 3, 11 PM — quietNov 4, 2 AM — quietNov 4, 5 AM — quietNov 4, 8 AM — 1 piece · 1 article — Google News 1Nov 4, 11 AM — quietNov 4, 2 PM — quietNov 4, 5 PM — quietNov 4, 8 PM — quietNov 4, 11 PM — quietNov 5, 2 AM — quietNov 5, 5 AM — quietNov 5, 8 AM — quietNov 5, 11 AM — quietNov 5, 2 PM — quietNov 5, 5 PM — quietNov 5, 8 PM — quietNov 5, 11 PM — quietNov 6, 2 AM — quietNov 6, 5 AM — quietNov 6, 8 AM — quietNov 6, 11 AM — quietNov 6, 2 PM — quietNov 6, 5 PM — quietNov 6, 8 PM — quietNov 6, 11 PM — quietNov 7, 2 AM — quietNov 7, 5 AM — quietNov 7, 8 AM — quietNov 7, 11 AM — quietNov 7, 2 PM — quietNov 7, 5 PM — quietNov 7, 8 PM — quietNov 7, 11 PM — quietNov 8, 2 AM — quietNov 8, 5 AM — quietNov 8, 8 AM — quietNov 8, 11 AM — quietNov 8, 2 PM — quietNov 8, 5 PM — quietNov 8, 8 PM — quietNov 8, 11 PM — quietNov 9, 2 AM — quietNov 9, 5 AM — quietNov 9, 8 AM — quietNov 9, 11 AM — quietNov 9, 2 PM — quietNov 9, 5 PM — quietNov 9, 8 PM — quietNov 9, 11 PM — quietYesterday, 2 AM — quietYesterday, 5 AM — quietYesterday, 8 AM — quietYesterday, 11 AM — quietYesterday, 2 PM — quietYesterday, 5 PM — quietYesterday, 8 PM — quietYesterday, 11 PM — quietToday, 2 AM — quietToday, 5 AM — quietToday, 8 AM — quietToday, 11 AM — quietToday, 2 PM — quietToday, 5 PM — quiet 1
Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 8:48 PM ET
  1. 1

    Analysts detail North Korea's evolution from disruption to financial theft

    Security experts and Japanese government reports highlight North Korea's decade-long strategic shift from disruptive attacks like the 2014 Sony Pictures breach toward stealing cryptocurrency and banking assets to finance nuclear weapons. Japan's foreign ministry warned that Pyongyang's cyber force has expanded into a 'full-scope national programme' approaching sophistication levels of China and Russia.

    “North Korean hackers have become increasingly efficient in hacking financial systems abroad and funnelling the stolen money into financing Pyongyang's nuclear weapons programme.”
    — The Independent reporting
    1. 4 outlets How North Korea became a hacking superpower

      first by Financial Times, 12d ago · also The Conversation, The Spec, FT

      2 more headlines
    2. 1 outlet What makes North Korea's state-linked hacker network so powerful?

      first by The Independent, 12d ago

  2. background

    Blockchain security firms attribute hack to North Korean TraderTraitor unit — TRM Labs, Chainalysis, and ZachXBT conclude with high confidence that the Binance breach was orchestrated by North Korea's TraderTraitor hacking unit, linked to the Lazarus Group. TRM Labs based its assessment on 'robust on- and off-chain intelligence.'

  3. background

    Binance suffers $2bn theft from compromised engineer's laptop — Hackers gain access to a Binance engineer's compromised laptop and make unauthorized transactions, stealing at least $2 billion from the exchange's wallets in what blockchain security firms assess as the largest cyber attack on a crypto exchange.