On Thursday, Binance, the largest crypto exchange in the world, lost more than $6 billion in digital assets to an attacker. Within hours, the investigators the industry trusts most had converged on one suspect: North Korea.

The size of the theft is hard to absorb. The question that will shape what follows is narrower: who did it, and how certain can anyone be?

The Investigators Speak

The first public signal came from ZachXBT, the independent blockchain investigator, who wrote on X that the attacker was “likely Lazarus.”

Lazarus Group is a hacking unit run by the North Korean state. Its known purpose is to steal money through cyber attacks and channel it into the regime’s illicit weapons program.

Late Thursday, TRM Labs went further. In a blog post that put the loss at $6.36 billion and called it the largest hack in history, the firm named TraderTraitor, a subunit of Lazarus, as the likely culprit. TRM said it held that assessment with “high confidence.”

Chainalysis reached the same conclusion. Its CEO, Jony Levin, said the firm assessed that the hack “was likely done by DPRK group TraderTraitor,” pointing to links with a previous hack.

Ido Ben-Natan, co-founder and CEO of the security firm Blockaid, framed it in terms of method. “The tactics and level of sophistication we’ve seen so far are consistent with the kinds of operations we’ve seen from DPRK,” he said in a statement. He also tied North Korean actors to several of this year’s major incidents, naming Kelp DAO, Bitget and Drift.

Three analytics shops and one independent investigator, all pointing the same way. That is about as close to consensus as this field gets in the first 24 hours.

“Likely” Is a Legal Word

Read the language again. Likely. High confidence. Consistent with. None of these is a finding.

That restraint is deliberate, and it deserves respect. Attribution in a state sponsored theft is not a parlor game. Once a nation state is named, the incident leaves the world of ordinary crime and enters the world of national security. The people who later touch those funds, whether at an exchange, a trading desk or a payments firm, will read that label as a warning.

There is also a dissenting note in the record, and it is the most interesting detail of the week. A person familiar with crypto investigations said there were “very few actors who could pull something like this off,” while cautioning that the hack had not been definitively attributed to Lazarus. Their reasoning was specific: Lazarus and other North Korean groups usually move and sell stolen funds faster and more efficiently than the Binance attackers did on Thursday.

That is exactly the kind of observation a careful lawyer wants on the table. Attribution in this space rests largely on pattern evidence: wallet behavior, laundering routes, tooling, links to past incidents. Pattern evidence is powerful. It is also the kind of evidence where a single anomaly, such as an unusually slow attacker, should keep everyone honest until the full picture settles.

The practical point is simple. “Likely Lazarus” today may become “confirmed Lazarus” next week. It may not. Anyone drawing legal or financial conclusions from this event should track which of those two sentences is actually true.

A Pattern Measured in Billions

If the attribution holds, it fits a long record. North Korea has been linked to most, if not all, of the largest hacks in crypto’s history. Lazarus is probably the best known threat actor in the space.

Its signature case until this week was the $1.46 billion theft from Bybit, the Dubai exchange, in February 2025. At the time it was the largest such attack ever recorded, and it accounted for the bulk of the $2.02 billion in crypto stolen that year.

The group is also believed to be behind the $292 million KelpDAO exploit this April and the $625 million Ronin Network hack in 2022.

Set Thursday’s number against that history. The Binance loss is more than four times the Bybit theft, and roughly three times the entire 2025 total. If North Korea is responsible, a single operation has outstripped a full year of its previous work.

The Laptop

Binance said in a late Thursday update that it had traced the attack vector to a compromised laptop belonging to a DevOps engineer.

That detail will get less attention than the dollar figure. It should get more.

The industry tends to talk about security in terms of cryptography, smart contracts and cold storage. Those defenses matter. But the entry point here, by the exchange’s own account, was one machine used by one person with operational access. The strongest vault design still sits inside an organization made of people, devices and credentials, and a capable attacker will look for the softest of those.

For any custodian, this is the uncomfortable lesson. The perimeter is not only technical. It is human, and it is as wide as the number of people with privileged access.

What Bitcoiners Should Take From This

For a bitcoiner, the deeper issue is concentration.

An exchange balance is not bitcoin you hold. It is a claim against an institution that holds assets on your behalf. When that institution is attacked, your position depends on its security, its reserves and its decisions, none of which you control.

Thursday’s event does not change that principle. It illustrates it at a scale the industry has never seen. When billions sit behind a single organization’s operational security, a compromise of one engineer’s laptop becomes a systemic event.

Self custody carries its own risks and responsibilities, and it is not the right answer for every holder in every situation. But the Binance hack is a clean reminder of what holding your own keys is meant to remove from the equation: dependence on someone else’s laptop.

What to Watch

Three threads will matter in the days ahead. Whether the attribution moves from “likely” to confirmed. How quickly the stolen funds begin to move, given the observation that this attacker has been slower than North Korea’s usual pace. And what further detail Binance releases about how the compromise unfolded.

Each of those will tell us more than the headline number ever could.

This article is commentary and analysis for informational purposes only. It is not legal, financial or investment advice, and nothing here is written in a professional capacity. Consult a qualified professional before acting on any of it.

For sharp, Bitcoin only coverage of law, regulation and policy, twice a week, subscribe to The Bitcoin Act at thebitcoinact.xyz.