In news that will surprise absolutely no one who has followed the career arc of the Lazarus Group, two major blockchain analytics firms have identified North Korea's state-backed hacking unit as the likely culprit behind the $6.3bn (£4.7bn) hack of Binance, the world's largest cryptocurrency exchange. TRM Labs and Chainalysis both say they have "high confidence" in the attribution, which is analyst-speak for "we're pretty sure, but we're not going to say it's definitely them until someone writes a memoir."

The Lazarus Group, also known as TraderTraitor - a name that sounds like a rejected Marvel villain - has been linked to a long list of cybercrimes. North Korea, one of the poorest countries in the world and a place where internet access is severely restricted for ordinary citizens, has long been accused of using cybercrime to finance itself. Pyongyang denies this, presumably with a straight face and a very secure server.

While the Binance hack is a financial matter, the regime's most spectacular suspected cyberattack was decidedly not. In 2014, Sony Pictures was targeted over the Hollywood film *The Interview*, which involves a plot to assassinate Kim Jong Un. The hack exposed thousands of embarrassing emails exchanged among the studio's top executives - a reminder that sometimes the most damaging weapon is just a really thorough inbox search.

Last year, the Federal Bureau of Investigation (FBI) said North Korea was responsible for the theft of $1.5bn on the Bybit exchange. After that incident, the agency said TraderTraitor moved quickly to launder and disperse the stolen assets, converting them to Bitcoin and other digital assets with the goal of eventually turning them into hard currency. The FBI has broadly accused North Korea of "illicit cybercrime and virtual asset theft activities" - a phrase that covers a multitude of sins and at least one Sony hack.

North Korea has systematically developed its cyber operations, recruiting the most promising students from universities and channeling them into hacker groups overseen by the country's intelligence agency, according to reports. Some of the cyberwarfare conducted takes place just over the nation's border in China, according to analysis from tech groups - because why hack from home when you can commute?

Much of the hacking activity has centred on monetary gain. North Korean hackers are also suspected in the theft of $620m worth of cryptocurrency in 2022. In this most recent heist, North Korean agents are accused of using a special authorisation to turn a Binance hot wallet - which is connected to the internet - into one that moved funds automatically to the attacker. TRM said it's likely the attacker gained access to Binance's hot wallet signing system as part of the scheme.

Binance has not directly responded to the BBC's queries about the incident's potential links to the area. The company initially said it thought an engineer's laptop had been compromised, allowing unauthorised withdrawals, but later said the attack was wider. "Our subsequent investigation has uncovered additional points of breach," Binance's co-CEO Richard Teng said, presumably while staring at a very large spreadsheet of missing money.

Some 80% of stolen assets have been secured, a Binance spokesperson said on Friday, but the rest remains unaccounted for - a tidy sum that is presumably being laundered through a series of increasingly creative crypto transactions.

If the accusations are true, the record-making heist shows how powerful suspected North Korean hackers have become - a sign that the tools of the hacking trade have grown sharper. Experts say the rise of artificial intelligence has also given threat actors new ways to carry out crime, through automation and other means. In this case, it's plausible that AI was used to infiltrate Binance's systems. As Chainalysis put it, the attacker used laundering patterns "we have not seen before" - which is either a chilling warning or a compliment, depending on your perspective.

Sign up for our Tech Decoded newsletter to follow the world's top tech stories and trends. Outside the UK? Sign up here.