The former Binance boss targeted by North Korean cybercriminals

Changpeng Zhao, an iconic figure in the crypto world and founder of Binance, has just revealed an intrusion attempt on his Google account. Behind this attack are hacker groups supported by governments, probably the notorious North Korean Lazarus collective.

When States Become Hackers, CZ’s Alert

Yesterday, Changpeng Zhao, co-founder of Binance, shared on X a worrying notification from Google. The message informed him that an attempt to steal his password was ongoing, orchestrated by “government-backed attackers”.

In his post, CZ immediately mentioned the Lazarus group, a North Korean hacker organization infamously known in the crypto world.

This alert is not an isolated case. Anndy Lian, blockchain expert and intergovernmental advisor, confirms that several government officials have received similar warnings. 

” I personally know a government official who received a message similar to CZ’s, saying his account is detected by government-backed hackers trying to steal his password.“, he explains. However, Google remains silent on the details of these attacks for security reasons.

The Lazarus group tops the list of suspects. This North Korean collective is considered the mastermind behind the most devastating crypto exploits. Last February 21, they allegedly orchestrated the record Bybit hack, stealing 1.4 billion dollars, the largest amount ever stolen in the industry. These funds would directly feed Pyongyang’s coffers, according to U.S. intelligence services.

A Threat That Intensifies and Diversifies

The attack against the founder of Binance is part of an alarming trend. North Korean hackers have escalated their operations in 2024, stealing 1.34 billion dollars in 47 distinct incidents. This amount represents a 102% increase compared to the 660 million stolen in 2023, according to Chainalysis data.

But their strategy is evolving. Three weeks before this intrusion attempt, CZ had already sounded the alarm on a new tactic: infiltration through employment. 

” They pose as job candidates in your company. This gives them a foot in the door, especially for job opportunities in development, security, and finance“, he warned on September 18. 

The Security Alliance (SEAL) organization has even compiled a directory of 60 North Korean agents operating under false identities to infiltrate American crypto platforms.

Concrete examples abound. In June, four North Korean agents disguised as freelance developers managed to steal 900,000 dollars from several crypto startups. Coinbase was also a victim of a data breach in May, exposing information of less than 1% of its users but potentially causing 400 million dollars in reimbursement fees.

Faced with this escalation, cybersecurity experts call for an urgent response. They recommend implementing dual authentication wallet management systems and real-time threat monitoring by artificial intelligence. 

The crypto industry must now contend with adversaries equipped with nearly unlimited state resources. Meanwhile, CZ continues his activities with YZi Labs, which has just announced a one billion dollar fund to support BNB Chain developers.