Attention around Thursday's Binance breach has shifted from frozen funds to attribution: several blockchain sleuths and analysis firms point to North Korea's Lazarus Group as the likely attacker. No official attribution has been made so far.

Binance estimates the incident's impact at $6.3B, with around $3B in crypto assets frozen. Its initial findings point to a compromised DevOps engineer's laptop that let the attacker reach a service container and submit unauthorized withdrawals. The exchange says it will cover all losses through its SAFU fund and company money.

If confirmed, it would be the regime's biggest crypto heist, roughly 4x the $1.5B taken from Bybit in 2025.

The attribution adds to a run of large exchange breaches: in September, Bitget lost more than $350M in a theft it also suspected North Korea of carrying out. Funds that are not yet frozen remain the main recovery risk.