ZachXBT Comments on Binance Attacker’s Identity

Blockchain investigator ZachXBT said the attacker behind Binance’s security incident may be linked to North Korea’s Lazarus Group, offering a tentative attribution as the exchange assessed the impact of the breach.

ZachXBT made the comment in a reply on X to a question about the attacker’s identity. He described Lazarus as a possibility, leaving responsibility unconfirmed rather than presenting a definitive identification.

Binance’s preliminary findings put losses at about $6.3 billion and said about $3 billion in assets had been frozen. The exchange also said it would reimburse users in full. Those figures outline the scale of the incident, while ZachXBT’s comment addresses a separate question: who may have carried it out.

The potential Lazarus connection would tie the incident to a North Korean hacking group, but the claim remains qualified. Binance’s preliminary loss and freeze figures do not themselves establish the attacker’s identity, and ZachXBT’s comment does not convert the suspected link into a confirmed finding.