Lazarus Group Linked to Record $6.3 Billion Binance Hack

TRM Labs attributes the attack to TraderTraitor, a hacking unit under the Lazarus umbrella, with high confidence. The sophisticated operation moved at least $3.5 billion across four blockchains in under an hour, bypassing standard security measures. Blockaid CEO Ido Ben-Natan described the method as a precise reprogramming of a major Ethereum hot wallet, where a single successful authorization allowed the attackers to drain holdings, including assets deposited mid-theft.

Binance reported that initial findings point to a compromised DevOps engineer's laptop, which likely granted unauthorized access to an internal service container. While the exchange confirmed no private keys were leaked, the breach allowed attackers to submit fraudulent withdrawal transactions. In response, Tether and Circle have frozen over $2.3 billion in stablecoins, while Binance has pledged to cover user losses through its SAFU fund. Withdrawals remain suspended as the exchange completes a security overhaul, with operations expected to resume within 48 hours.