- •Hackers linked to state‑backed groups attempted to access Binance co‑founder Changpeng Zhao’s Google account, raising alarms about North Korean cyber threats.
- •The Lazarus Group, infamous for past crypto thefts including a $1.4 billion Bybit hack, is a primary suspect.
- •Experts warn that cryptocurrency companies must strengthen cybersecurity measures, such as dual wallet management and AI‑based threat monitoring, to prevent growing attacks from sophisticated government‑backed actors.
Hackers tried to access the Google account of Binance co‑founder Changpeng Zhao, signaling a new wave of threats from state‑backed actors, particularly North Korea’s Lazarus Group. Zhao shared the Google warning publicly, noting that attackers appeared to be attempting to steal his password. He downplayed immediate personal risk but highlighted the persistent nature of these campaigns, adding that even minor accounts linked to exchanges or social media could be targeted for reconnaissance purposes.
NORTH KOREAN THREATS TARGETING CRYPTO PLATFORMS
The Lazarus Group has a long history of major crypto exploits, including the $1.4 billion Bybit hack in February, marking one of the largest incidents in the sector. US intelligence reports describe a sophisticated network of agents posing as IT workers, funneling stolen funds back to Pyongyang. Blockchain adviser Anndy Lian confirmed similar government‑backed hacking alerts were received by other high‑profile individuals. Despite contacting Google, victims often receive limited information for security reasons, leaving potential risks largely unaddressed. Analysts warn these attacks are increasingly automated and coordinated across multiple platforms simultaneously.
MEASURES CRYPTOCURRENCY FIRMS SHOULD TAKE
This attempted breach comes amid heightened North Korean activity targeting crypto firms through employment schemes, bribes, and social engineering. Zhao previously warned about operatives posing as job applicants to infiltrate companies, especially in development, security, and finance. Security Alliance (SEAL) reported at least 60 North Korean agents impersonating IT professionals to access sensitive data. Recent incidents include Coinbase’s May breach, affecting under 1 % of users and potentially costing up to $400 million, and four North Korean operatives stealing $900,000 from startups in June. Cybersecurity experts note that continuous staff training and monitoring suspicious communication patterns are equally essential alongside technical defenses.
Experts emphasize that cryptocurrency companies must adopt stricter security protocols, including dual wallet management, multi‑factor authentication, and real‑time AI threat monitoring, to mitigate these persistent risks. As North Korean hackers continue to target the sector, firms and individuals must remain vigilant to protect digital assets.
With cyberattacks growing both in frequency and sophistication, the Binance incident serves as a critical reminder that high‑profile figures and companies remain prime targets for state‑backed operations.