Binance Hack Linked to Lazarus Group by TRM Labs and ZachXBT
Key Summary
Forensic data compiled by TRM Labs and on-chain investigator ZachXBT explicitly tied the recent Binance security breach to North Korea's state-sponsored Lazarus Group, exposing sophisticated money laundering routes across multiple DEX platforms.
Key Bullets
- On-chain analysis by ZachXBT and TRM Labs confirmed North Korea's Lazarus Group orchestrated the recent security breach against Binance.
- Stolen digital assets moved through 1,428,446 distinct addresses before conversion into privacy coins on automated DEX pools.
- Investigators traced 85.4% of the drained capital across cross-chain bridges within 48 hours of the initial exploit.
- Compliance officers at major CEX venues froze $12.5M USDT tied directly to the malicious infrastructure.
Blockchain Forensics Pinpoint North Korean Hackers
Forensic data compiled by TRM Labs and independent investigator ZachXBT explicitly tied the recent Binance security breach to North Korea's state-sponsored Lazarus Group on Tuesday. On-chain transaction records confirm the threat actors moved stolen capital through complex routing channels across multiple liquidity pools. The hackers executed the transfer within minutes of breaching the perimeter defenses. Security teams responded immediately.
Investigators mapped the exact wallet clusters used to drain user funds from hot wallets managed by the exchange. Public blockchain ledgers show the funds bypassed traditional compliance checkpoints before hitting privacy-focused protocols. Funds vanished fast.
Laundering Routes Span Cross Chain Bridges
Data gathered by TRM Labs analysts revealed that the stolen tokens were immediately fragmented into smaller tranches to evade automated surveillance tools. The perpetrators swapped native assets for privacy-centric coins across various DEX venues to obscure the ultimate destination of the capital. Exchange order-book depth monitored by market trackers showed unusual volume spikes during the routing phase. Liquidity dried up.
Public filings and blockchain telemetry indicate the actors utilized automated cross-chain bridges to disperse the illicit capital across separate blockchain networks. Compliance teams across competing platforms blacklisted the deposit addresses within hours. Trading desks adjusted positions.
About CryptoNewsFree Market Intelligence Wire
The CryptoNewsFree Market Intelligence Wire provides rapid, objective coverage of breaking crypto developments, regulatory actions, and market liquidity trends. Our reporting strictly follows our Editorial & Verification Standards.