As investigators examined who was behind the Binance attack, assessments by ZachXBT and TRM pointed suspicion toward North Korea-linked group Lazarus.
According to CoinDesk, on-chain investigator ZachXBT said Lazarus was the likely culprit. Blockchain analytics firm TRM offered a more detailed assessment, pointing to TraderTraitor, a subgroup of Lazarus, and described its confidence in this conclusion as high.
In the wake of the attack, the question of who carried out the operation came to the fore alongside wallet movements and losses. However, the attack has not yet been definitively attributed to this group.
Tactics overlap, but the movement of funds differs
Ido Ben-Natan, co-founder and CEO of Blockaid, said the tactics and technical sophistication seen in the attack were consistent with methods they had previously encountered in North Korea-linked operations. This assessment supports the suspicions of ZachXBT and TRM.
However, a person familiar with crypto investigations who spoke to CoinDesk pointed to a notable difference: the movement and sale of funds stolen from Binance proceeded more slowly than in past operations by Lazarus and other North Korea-linked groups. The same person said that few actors could carry out an attack of this scale, but that attribution had not yet been confirmed.
Group also linked to Bybit attack
Lazarus is a North Korea-linked group known for major attacks in the crypto sector. The attack in February 2025 in which assets worth approximately $1.46 billion were stolen from Bybit was also linked to the group. This history is part of the context that helps explain why investigators are focusing on Lazarus in the Binance incident.
Binance’s own initial investigation points to a possibly compromised laptop belonging to a DevOps engineer as the attack’s likely starting point. We previously covered the exchange’s initial technical findings; the Lazarus assessment is being presented as an attribution by investigators and analytics firms, not as a definitive identification of the culprit announced by the exchange.
Not investment advice.