A hot wallet is supposed to be convenient, not impregnable. It stays connected to the internet so that an exchange can pay customers quickly, and that convenience is exactly what attackers are now accused of exploiting at Binance, the world's largest cryptocurrency exchange. The theft is valued at $6.3bn (£4.
7bn), and two blockchain analytics firms, TRM Labs and Chainalysis, say they have strong evidence that it was carried out by the Lazarus Group, a North Korean state-backed unit also known as TraderTraitor. According to TRM, the attackers used a special authorisation to convert a Binance hot wallet into one that automatically sent funds to them. The firm thinks it is likely they first gained access to the exchange's signing system, the mechanism that approves transactions. Binance has not directly answered the BBC's questions about the incident.
The attribution fits a pattern. Last year the FBI said North Korea was behind the theft of $1.5bn from the Bybit exchange, and that TraderTraitor moved quickly to launder the proceeds, converting them into Bitcoin and other assets with the aim of eventually obtaining hard currency. Hackers were also suspected in a $620m theft in 2022.
Pyongyang has long denied financing itself through cybercrime. What makes this significant is the machinery behind it. Reports describe a state that recruits its most promising university students and channels them into hacking groups overseen by its intelligence agency, with some operations reportedly run from just across the border in China.