Lazarus hacker group steals $6.3 billion from Binance cryptocurrency exchange
North Korean state hackers have robbed the Binance cryptocurrency exchange of more than six billion dollars in a 20-minute attack. It is the largest known theft by the legendary Lazarus group.
Record heist at Binance
According to Süddeutsche Zeitung, North Korean hackers have robbed the Binance cryptocurrency exchange of $6.3 billion. The attack lasted approximately 20 minutes and yielded cryptocurrencies in the form of Ethereum, Bitcoin, and stablecoins from Tether and Circle. Practically all cybersecurity experts attribute the theft to the group Tradertraitor, a sub-group of the state hacker group Lazarus.
The FBI confirmed North Korea as the perpetrator, basing this in part on the fact that the hack reused cryptocurrency addresses that Lazarus had already deployed in an attack in 2025. US President Donald Trump publicly disagreed with this assessment, whilst the global cybersecurity community agreed with the FBI.
The Lazarus legend
According to experts, the hacker group Lazarus has existed since around 2009, gaining worldwide notoriety in 2014 through an attack on the film studio Sony Pictures. Under the name "Guardians of Peace", the hackers stole gigabytes of data and extorted the studio because it had produced the film "The Interview" — a film about the assassination of North Korean leader Kim Jong-un. Sony initially cancelled the film's release and gave in to the extortion.
Then-Senator John McCain warned that Sony's capitulation would only encourage the perpetrators to proceed even more aggressively in future. Twelve years later, it shows: McCain was right. From then on, Lazarus did not specialise in film studios, but rather in the more lucrative cryptocurrency industry.
North Korea as a cyber power
Ruler Kim Jong-un recognised early on the potential of asymmetrical cyberattacks for his country, which suffers under international sanctions. According to estimates, North Korea has a veritable hacker army of more than 8,000 people. The state hackers are regarded as world-class and can compete with hackers from any industrial nation.
Whilst North Korea's classical economic performance is low — the country reportedly last exported goods worth approximately $470 million, with major items including wigs and eyelashes — cyberattacks are the most successful export business. The hackers bring foreign currency back into the country, which benefits the state treasury.
Billions through cryptocurrency hacks
A group of experts appointed by the United Nations estimated in 2024 that Lazarus had stolen at least three billion dollars through crypto hacks between 2017 and 2023. The blockchain analysis company Chainalysis put this figure at more than six billion dollars two years later. With the Binance heist, another more than six billion dollars were added in one go — the previous record was approximately $1.5 billion from an attack on the platform Bybit in 2025.
Partial freeze of the loot
Lazarus will probably not be able to keep the full amount. The stablecoin companies Tether and Circle froze approximately $2.4 billion of the stolen coins immediately after the hack. Unlike with decentralised cryptocurrencies, stablecoin companies retain control over all issued coins — a centralisation that is criticised by crypto purists, but in this case proved to be a protective measure.
Binance under scrutiny
The victim of the hack, the Binance cryptocurrency exchange, is regarded together with Coinbase as the backbone of the cryptocurrency industry. The platform was founded by Changpeng "CZ" Zhao, who originally built it in China, later moved it to Malta, and has had no fixed company headquarters since. Regulatory authorities in Germany, the United Kingdom and elsewhere warned for years about Binance as a risk to consumers due to lack of compliance. US law enforcement agencies eventually prosecuted CZ for violations of money-laundering laws. He negotiated a deal, pleaded guilty, and Binance paid four billion dollars in penalties. A judge sentenced CZ to four months in prison. Donald Trump later pardoned him.
Source: Süddeutsche Zeitung