The outflow of assets from Binance, the world’s largest cryptocurrency exchange, is suspected to involve the North Korean hacker TT, and the damage has expanded to include Japanese companies among the targets. Further investigations may reveal additional facts.
The outflow of assets from Binance, one of the largest such incidents on record, is strongly suspected to have involved the North Korean hacking group TraderTraitor (TT), and the amount is reported to have reached approximately $6.3 billion (about ¥1 trillion). The FBI has determined that TT carried out the crime, which is believed to have taken approximately 20 minutes.
TT is believed to be part of Lazarus, a subordinate organization of North Korea’s Reconnaissance General Bureau, which is responsible for the country’s overseas operations, and is said to have been formed in 2016–2017. It was reported that approximately $2.58 billion worth of crypto-assets were stolen in 2016–2017, accounting for approximately 90% of the assets stolen by North Korea. Japanese businesses are also believed to have been targeted in the past.
TT specializes in impersonating corporate recruiters and executives to send malware. In the incident involving the outflow of assets from DMM Bitcoin, impersonation using LinkedIn is believed to have been involved. In 2024, the outflow of approximately $1.5 billion worth of assets from Bybit was also reportedly determined to have been carried out by TT.