Who is North Korea’s “elite” hacker group? Why is he the number one suspect in Binance’s $6.3 billion theft?

Two major blockchain analytics firms say they have sufficient intelligence to suggest that a hacker group backed by the North Korean government may be behind the $6.3 billion (£4.7 billion) hack of Binance, the world's largest cryptocurrency exchange.

Blockchain analysis companies TRM Labs and Chainalysis both said they had "high confidence" that the attack was launched by the North Korean hacker group "Lazarus Group". This organization is also known as "TraderTraitor".

This is just the latest in a series of recent hacking incidents alleged to be linked to North Korea. North Korea is one of the poorest countries in the world, and people's access to the Internet is severely restricted.

Experts allege that North Korean leader Kim Jong Un's government relies on cybercrime for funding, a charge Pyongyang has long denied.

The most high-profile of North Korea's alleged hacking attacks was not for money, but the 2014 cyber attack on Sony Pictures. At that time, the company produced the Hollywood movie "The Interview" (also translated as "The Interview"), which revolved around a conspiracy to assassinate Kim Jong-un.

The hack resulted in the leak of thousands of emails between Sony Pictures executives, many of which were embarrassing to the company.

The FBI said last year that North Korea was responsible for the theft of $1.5 billion from cryptocurrency exchange Bybit.

After the incident, the FBI stated that "Trader Traitor" took quick action to clean and disperse the stolen assets, converting them into Bitcoin and other digital assets, with the goal of eventually converting them into currencies that can be actually used.

The FBI has also broadly accused North Korea of ​​engaging in "illegal cyber crimes and virtual asset theft activities."

According to multiple reports, North Korea has been systematically developing its cyberattack capabilities, recruiting the most promising students from universities and placing them in hacking groups overseen by North Korea's intelligence agencies.

Analysis by technology companies also shows that some of North Korea’s cyber warfare activities are conducted in China, which borders it.

Most of North Korea's hacking activities are aimed at obtaining money.

North Korean hackers are also suspected of being involved in a cryptocurrency theft worth $620 million in 2022.

In the latest case, North Korean hackers are accused of using a special authorization to change the operation of a Binance "hot wallet" connected to the Internet, allowing it to automatically transfer funds to the attackers.

TRM stated that the attackers likely gained access to Binance’s hot wallet signing system during this operation.

Binance did not directly respond to the BBC’s inquiry regarding possible links to North Korea.

The company initially said it suspected an engineer's laptop had been compromised, allowing hackers to extract assets without authorization, but later said the attack was broader than initially known.

"Our subsequent investigation uncovered other compromised links," Binance co-CEO Richard Teng said.

A Binance spokesperson said on Friday (October 30) that about 80% of the stolen assets have been preserved, but the whereabouts of the remaining assets are still unknown.

If the allegations are true, the record theft shows how powerful hackers suspected of originating from North Korea have become, and reflects the increasing sophistication of the tools and techniques they use.