ZachXBT: The Binance attack is likely to have been carried out by the Lazarus Group
On October 30, on the X platform, chain detective ZachXBT replied to “Who is the hacker? Korean?” by saying: “Likely Lazarus Group (DPRK)”. The reply was directed at the ongoing Binance security incident.
ZachXBT’s statement is a personal judgment. Binance has not yet confirmed the attacker’s identity and has not released a complete technical postmortem. On the same day, Binance said its preliminary investigation showed that the incident may have involved a DevOps engineer’s computer being compromised, estimated the impact at about $6.3 billion, had frozen about $3 billion, and the company will use the SAFU fund and company funds to cover all losses.
Lazarus Group is a hacker organization associated with North Korea and has previously been attributed by U.S. agencies to multiple crypto thefts, including the about $1.5 billion Bybit incident in February 2025 (which the FBI called TraderTraitor). ZachXBT has long tracked related fund flows and has publicly disclosed investigations into related money laundering networks.
Original sources:
Title: Likely Lazarus Group (DPRK) Publisher: ZachXBT (@zachxbt) Publication date: 2026-10-30 URL: https://x.com/zachxbt/status/2115973357753733157 Source nature: original post by the party involved Verification status: the full text and contextual replies were actually read in this case, verified on 2026-10-30 Supporting content: ZachXBT’s judgment on the identity of the Binance attacker, expressed as “Likely Lazarus Group (DPRK)”
Title: Whos the hacker ?? Korean? Publisher: Ghali (@SG2Trader) Publication date: 2026-10-30 URL: https://x.com/SG2Trader/status/2115972948943151207 Source nature: original post by the party involved Verification status: the full text was actually read in this case, verified on 2026-10-30 Supporting content: the question to which ZachXBT replied
Title: Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop... Publisher: Binance (@binance) Publication date: 2026-10-30 URL: https://x.com/binance/status/2115993361517891592 Source nature: official announcement Verification status: the full text was actually read in this case, verified on 2026-10-30 Supporting content: Binance’s official statements on the scale of the incident, the possible intrusion path, the amount frozen, and covering the losses (not involving confirmation of the attacker’s identity)
ABAB AI Insight
ZachXBT is an independent on-chain investigator who has long tracked crypto theft and laundering paths. After the February 2025 Bybit incident, he publicly linked the fund flows to patterns associated with Lazarus, and in later investigations he disclosed infiltration operations against related Chinese money-laundering networks. His reply this time was a brief judgment in response to a question, without detailed on-chain evidence or a full analysis attached.
Lazarus Group (and subordinate clusters such as TraderTraitor) has repeatedly been attributed by the U.S. Treasury, the FBI and other agencies to large-scale thefts targeting exchanges and cross-chain bridges, with funds often moved through multi-chain hops, mixers and third-party laundering networks. The approximately $1.5 billion Bybit incident in 2025 was one of its largest publicly attributed cases in recent years. In this Binance incident, ZachXBT’s judgment is based on his past pattern recognition, but as of now no official agency or Binance has confirmed the same attribution.
Compared with the Bybit incident, Binance described this attack path as entering a service container through a compromised engineer’s computer to submit unauthorized withdrawals, rather than a direct private-key leak. If later on-chain fund flows show patterns similar to known Lazarus laundering clusters (such as specific intermediary addresses and cross-chain behavior), ZachXBT’s judgment may gain more support; for now, the judgment remains the investigator’s personal assessment.
This statement links the Binance incident to North Korea-related network threat patterns, but it has not changed the official commitment to loss coverage and user fund safety. The indicators to watch are whether a later official technical postmortem or law-enforcement agency issues an attribution statement, and whether the stolen funds show on-chain features overlapping with existing Lazarus clusters.
ABAB News · Cognitive Law
An investigator’s “likely” judgment is not the same as an official attribution or a confirmed fact.
In large-scale exchange incidents, pattern recognition often appears before formal confirmation.
Attack-path descriptions and fund-flow attribution can exist in parallel and do not automatically mean the same thing.