The FBI has officially concluded that the Binance hack was perpetrated by a North Korean hacking group. The FBI has previously attributed numerous major cryptocurrency, financial, and cybersecurity incidents to North Korean hacking groups (primarily the Lazarus Group/APT38 and its crypto-focused subgroup, TraderTraitor). These activities are considered by the FBI to be a key means for the North Korean regime to obtain foreign exchange, circumvent sanctions, and fund its nuclear and missile programs through cybercrime. This undoubtedly constitutes state-sponsored cyberterrorism. Here's a summary of key cases previously confirmed by the FBI as being the work of North Korean hacking groups: 1) March 2022: Ronin Network (Axie Infinity cross-chain bridge): Approximately $620 million. The FBI explicitly identified the Lazarus Group and APT38 as responsible. 2) June 2022: Harmony Horizon Bridge: Approximately $100 million. The FBI identified the Lazarus Group (APT38) and its association with TraderTraitor activities. 3) June 2023: Atomic Wallet: Over $100 million. The FBI subsequently confirmed related North Korean actors (consistent with Lazarus/TraderTraitor activities) in a statement. 4) September 2023, Stake.com: Approximately $41 million. The FBI publicly confirmed that the Lazarus Group (APT38) was responsible, and indicated that the same group of perpetrators were also involved in other cryptocurrency thefts in 2023. 5) May 2024, Japan's DMM Bitcoin: Approximately $308 million (4502.9 BTC). The FBI, together with the U.S. Department of Defense Cybercrime Center (DC3) and the Japanese National Police Agency, attributed the theft to TraderTraitor. 6) February 2025, Bybit: Approximately $1.5 billion. The FBI issued a formal Public Safety Announcement (PSA), confirming North Korea's responsibility and naming the activity "TraderTraitor." In addition, the FBI and related U.S. agencies have attributed earlier major incidents to North Korean cyber actors, including: 1) The 2014 Sony Pictures hack (Lazarus Group). 2) The 2016 Bangladesh Central Bank SWIFT theft (approximately $81 million successfully transferred, related to APT38/Lazarus). 3) The 2017 WannaCry ransomware attack (attributed to Lazarus by the US Department of Justice and others). TraderTraitor is a primary tag used by the FBI since its joint warning in 2022 to describe North Korea's social engineering and malware activities targeting the crypto industry, often overlapping with Lazarus/APT38. The FBI has also consistently issued warnings about the long-standing activity of North Korean "remote IT workers" using identity fraud to earn money by working for US and European companies, belonging to the same category of state-sponsored income generation mechanisms.