TRM Assesses Lazarus Group Behind Binance’s $6.3 Billion Theft

TRM Labs assessed with high confidence that TraderTraitor, a unit of North Korea’s Lazarus Group, carried out Binance’s reported $6.3 billion theft, though officials have not confirmed the attribution. Assets from Binance wallets on 10 blockchains began moving to one attacker at 4:05 p.m. ET Oct. 29 (20:05 UTC). By 10:23 p.m. ET (02:23 UTC Oct. 30), Binance’s preliminary investigation pointed to a DevOps engineer’s laptop as a likely entry point for unauthorized withdrawals. Binance said about $3 billion had been frozen on-chain and its SAFU fund and company resources would cover the full loss.