Why North Korea's 'elite' hackers are the prime suspect in major Binance hack

ByLily Jamali North America Technology correspondent.

Key points

• Last year, the Federal Bureau of Investigation (FBI) remarked North Korea was responsible for the theft of $1.5bn on the Bybit exchange.
• North Korean hackers are additionally suspected in the theft of $620m worth of cryptocurrency in 2022.
• As well as Chainalysis, the Lazarus Group, a North Korean hacking unit additionally known as TraderTraitor, was identified "with high confidence" by TRM Labs.
• Experts accuse the administration of North Korean leader Kim Jong Un of relying on cybercrime to finance itself, something Pyongyang has long denied.
• Crypto giant Binance attempting to recover $6.3bn stolen in hack linked to North Korea.

Two major blockchain analytics firms say they have robust intelligence pointing to a North Korean state-backed group as the probable culprits in the $6.3bn (£4.7bn) hack of Binance, the world's largest cryptocurrency exchange.

This incident is just the latest linked to the country, one of the poorest in the world and where access to the internet is severely restricted.

Though not financial, the nation's most spectacular suspected hack took place in 2014. The target: Sony Pictures. It had created the Hollywood film The Interview. The film involves a plot to assassinate Kim.

Notably, the resulting hack exposed thousands of embarrassing emails exchanged among the studio's top executives.

Who could be behind the Binance hack and what we know so far.

In the aftermath of that incident, the agency remarked TraderTraitor had moved to swiftly launder and disperse the stolen assets, converting them to Bitcoin and other digital assets with a goal of eventually turning them into hard currency.

For context, the FBI has broadly accused North Korea of "illicit cybercrime and virtual asset theft activities".

As reports indicate, the nation has systematically developed its cyber operations, recruiting the most promising students from universities and channeling them into hacker groups overseen by North Korea's intelligence agency.

Some of the cyberwarfare conducted takes place just over the nation's border in China, according to analysis from tech groups. Much of its hacking activity has centred on monetary gain.

In this most recent heist, North Korean agents are accused of using a special authorisation to turn a Binance hot wallet. It is connected to the internet, into one that moved funds automatically to the attacker.

TRM remarked it's probable the attacker gained access to Binance's hot wallet signing system as part of the scheme.

Binance has not directly responded to the BBC's queries regarding the incident's potential links to the area.

Notably, the firm had initially stated it thought an engineer's laptop had been compromised, allowing unauthorised withdrawals, but afterwards remarked the attack was wider.

"Our subsequent investigation has uncovered additional points of breach, " Binance's co-CEO Richard Teng remarked.

Some 80% of stolen assets have been secured, a Binance spokesperson remarked on Friday, but the rest remains unaccounted for.

If the accusations are true, the record-making heist demonstrates how powerful suspected North Korean hackers have become – a sign that the tools of the hacking trade have grown sharper.

Experts say the rise of artificial intelligence has additionally given threat actors new ways to carry out crime, through automation and other means.

In this case, it's plausible that AI was applied to infiltrate Binance's systems.

As Chainalysis put it, the attacker applied laundering patterns "we have not seen before".

For now, why North Korea' s ' elite' hackers are the prime suspect in major Binance remains the part of the story worth watching, and further updates are likely as more details are confirmed.