FBI points to North Korea in Binance theft

$6.3B in virtual assets drained in 20 minutes

Kaspersky analyzes separate 'Operation Flashhole'

Korean OB-GYN society domain flagged in malware indicators

[123rf]
[123rf]

Cyberattacks linked to North Korea are expanding on two fronts — large-scale virtual asset theft and corporate espionage targeting South Korean firms. The FBI has identified a North Korean group called TraderTraitor as the actor behind the theft of $6.3 billion in virtual assets from Binance. Separately, cybersecurity firm Kaspersky disclosed that a Lazarus Group operation targeting South Korean companies used web addresses belonging to domestic organizations — including the Korean Society of Obstetrics and Gynecology — as command-and-control indicators for malware. The two reports do not establish a direct link between the two incidents.

In the Binance hack, roughly $6.3 billion in assets were moved out of multiple blockchain wallets. Blockchain analytics firm TRM Labs found that most of the assets were transferred within about 20 minutes. The FBI said the stolen assets were largely converted into Ethereum and could be laundered further through decentralized finance platforms and instant exchange services.

The FBI attributed the attack to TraderTraitor, the same group previously linked to last year's $1.5 billion hack of Bybit. The Binance incident, which dwarfs that earlier breach in scale, illustrates how North Korea-linked hackers are increasingly targeting large sums through virtual asset theft.

Kaspersky's report on Operation Flashhole describes a separate cyber-espionage campaign with different objectives and methods, aimed at South Korean companies. The indicators of compromise listed in the report include a subdomain of the Korean Society of Obstetrics and Gynecology's website, along with web addresses belonging to domestic media outlets and construction companies. Kaspersky classified some of those addresses as command-and-control servers for malware it calls ClientHub.

A command-and-control server is the communication hub through which attackers send instructions to infected machines and retrieve stolen data. Routing malicious traffic through legitimate websites can make it harder to detect, as the communications blend in with normal web traffic. However, the inclusion of a web address in the indicators of compromise does not by itself confirm that the site's server was compromised or that personal data was leaked. Kaspersky's report does not specify when each site was breached, the extent of any intrusion, or whether information was exfiltrated.

Kaspersky said Operation Flashhole has been active since July 2025 and has affected at least three organizations in South Korea's software, construction and wired telecommunications equipment manufacturing sectors. Attackers are believed to have sent targets emails containing links to fake resume or portfolio sites tailored to the recipient's line of work, then exploited CrossWeb EX — a financial security program widely used in South Korea — during the infection process. Kaspersky assessed the operation as attributable to Lazarus Group with medium-to-high confidence.

The Binance incident has been analyzed as a large-scale virtual asset heist, while Operation Flashhole appears to be an espionage campaign targeting South Korean businesses. Though the objectives and intrusion methods differ, the fact that North Korea-linked groups are adapting their tactics to pursue both money and intelligence underscores the growing need for South Korean companies to review their cybersecurity posture.


attom@heraldcorp.com