Who is North Korean Lazarus Group, how they stole $6.3 billion from world's biggest crypto exchange Binance from a single laptop in just 20 minutes?

North Korea-linked hacking group Lazarus is suspected of orchestrating a cryptocurrency theft worth approximately $6.36 billion from Binance, the world's largest cryptocurrency exchange, after exploiting a vulnerability in one of its digital wallets. Blockchain investigators and analytics firms have linked the attack to the group, although the attribution has not been conclusively established.

Blockchain analytics firm TRM said it had high confidence that TraderTraitor, a North Korean hacking unit associated with Lazarus, was responsible for the attack. Blockchain investigator ZachXBT also identified Lazarus as a likely suspect in a post on X. However, a person familiar with cryptocurrency investigations told CoinDesk that the attack had not been definitively attributed to the group.

According to TRM's analysis, approximately $6.36 billion worth of cryptocurrency was transferred from Binance-linked wallets to addresses controlled by the attacker across 10 blockchains. The value was calculated using the prices of the assets when they were stolen. At current prices, the stolen holdings are worth approximately $6.23 billion.


The attack involved several cryptocurrencies, including Ethereum, Bitcoin, XRP, USDT and USDC. Investigators said the operation was prepared at least 36 hours before the first major transfers took place on October 29.

Also Read: Binance hacked: Who stole the money, where has the stolen $6.3 billion gone, and how much has been recovered? Will you lose your Bitcoin?

Who is North Korea's Lazarus Group?

Lazarus Group is a North Korean state-linked hacking operation known for targeting financial institutions, cryptocurrency exchanges and other organisations through cyberattacks. The group is widely regarded as one of the most prominent threats in the cryptocurrency sector.

North Korea has been linked to several major cryptocurrency thefts, with stolen digital assets believed to provide funds for activities connected to the country's sanctioned weapons programmes. Lazarus and associated hacking units have been accused of stealing billions of dollars through cyber operations.

One of its most significant alleged operations was the February 2025 attack on Dubai-based cryptocurrency exchange Bybit, in which approximately $1.46 billion was stolen. At the time, it was the largest cryptocurrency theft recorded. The incident accounted for a substantial portion of the approximately $2.02 billion in cryptocurrency stolen during 2025.

The group has also been linked to other major attacks, including the $625 million theft from the Ronin Network in 2022 and an exploit worth approximately $292 million involving KelpDAO in April.

The Binance attack has been associated with TraderTraitor, which TRM identified as a subunit of Lazarus. The assessment is based on blockchain analysis, but investigators have cautioned that the attribution remains unconfirmed. An individual familiar with cryptocurrency investigations also noted that the movement of funds in this case appeared slower and less efficient than what has typically been observed in operations attributed to North Korean hacking groups.

How did the Binance cryptocurrency theft happen?

According to TRM's investigation, preparations for the attack began at least 36 hours before the cryptocurrency was stolen.

The operator's wallet received three small withdrawals from Tornado Cash, a cryptocurrency-mixing service designed to make the origins of digital assets harder to trace. These transfers began on the morning of October 28.

On October 29, the attacker deployed an initial piece of code and tested it on two wallets. A later version was rehearsed on a third wallet, with the test funds subsequently transferred back to the operator. Approximately four hours after this rehearsal, the same code was installed on a Binance hot wallet.

A hot wallet is a cryptocurrency wallet connected to the internet and used by an exchange to process transactions, including customer withdrawals. Because it remains online, it is more exposed to certain cyber threats than offline storage.

The first major transfers occurred on the XRP Ledger between 20:05 and 20:09 UTC. Five Binance wallets sent a combined 233.46 million XRP to a single address controlled by the attacker, leaving the original wallets with only their minimum balances. The stolen XRP remained at that address at the time of the analysis.

Further transfers followed across Binance wallets on Solana and Optimism. At approximately 20:20 UTC, a Bitcoin hot wallet transferred 18,270 BTC to an attacker-controlled address. The funds were then divided into smaller batches of roughly 1,000 BTC and 100 BTC through a process known as a peel chain, which can make the movement of stolen cryptocurrency more difficult to track.

A Binance hot wallet on the Tron network subsequently transferred 612.7 million USDT and 46.4 million TRX to the attacker.

How the attacker gained control of the Binance hot wallet

The central part of the operation involved exploiting a feature introduced through Ethereum's Pectra upgrade in May 2025. Known as EIP-7702, the feature allows a regular cryptocurrency wallet to delegate control of certain operations to a smart contract through a signed authorisation.

In this case, the attacker submitted a transaction containing 50 authorisations, each signed by the Binance hot wallet and pointing to a malicious contract. The contract accepted instructions only from the attacker's operator wallet.

The attacker prepared the authorisations for 50 consecutive transaction counts, known as nonces. Since Binance's hot wallet regularly processes withdrawals, its nonce changes with each transaction. Preparing multiple authorisations increased the chances that at least one would remain valid when the attacker's transaction was executed.

One of the authorisations matched the wallet's transaction count, allowing the attacker to activate the malicious contract.

Three minutes and 24 seconds after the delegation, the attacker instructed the wallet to transfer its entire balance to an address under their control. The transaction moved 167,464 ETH and 63 other tokens, including 1.615 billion USDT.

The attacker retained control of the delegated wallet and continued transferring incoming funds. Further sweeps took place at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC.

The compromised wallet also acted as the executor for a separate Binance smart account, allowing the attacker to withdraw another 823 million USDC. Stablecoin issuer Circle froze those funds shortly afterwards.