Two major blockchain analytics firms say they have robust intelligence pointing to a North Korean state-backed group as the likely culprits in the $6.3bn (£4.7bn) hack of Binance, the world's largest cryptocurrency exchange.
The Lazarus Group, a North Korean hacking unit also known as TraderTraitor, was identified "with high confidence" by TRM Labs, as well as Chainalysis.
This incident is just the latest linked to the country, one of the poorest in the world and where access to the internet is severely restricted.
Experts accuse the government of North Korean leader Kim Jong Un of relying on cybercrime to finance itself, something Pyongyang has long denied.
Though not financial, the nation's most spectacular suspected hack took place in 2014. The target: Sony Pictures, which had made the Hollywood film The Interview. The film involves a plot to assassinate Kim.
The resulting hack exposed thousands of embarrassing emails exchanged among the studio's top executives.
Last year, the Federal Bureau of Investigation (FBI) said North Korea was responsible for the theft of $1.5bn on the Bybit exchange.
In the aftermath of that incident, the agency said TraderTraitor had moved to quickly launder and disperse the stolen assets, converting them to Bitcoin and other digital assets with a goal of eventually turning them into hard currency.
The FBI has broadly accused North Korea of "illicit cybercrime and virtual asset theft activities".
The nation has systematically developed its cyber operations, recruiting the most promising students from universities and channeling them into hacker groups overseen by North Korea's intelligence agency, according to reports.
Some of the cyberwarfare conducted takes place just over the nation's border in China, according to analysis from tech groups.
Much of its hacking activity has centred on monetary gain.
North Korean hackers are also suspected in the theft of $620m worth of cryptocurrency in 2022.
In this most recent heist, North Korean agents are accused of using a special authorisation to turn a Binance hot wallet, which is connected to the internet, into one that moved funds automatically to the attacker.
TRM said it's likely the attacker gained access to Binance's hot wallet signing system as part of the scheme.
Binance has not directly responded to the BBC's queries about the incident's potential links to the area.
The company had initially said it thought an engineer's laptop had been compromised, allowing unauthorised withdrawals, but later said the attack was wider.
"Our subsequent investigation has uncovered additional points of breach," Binance's co-CEO Richard Teng said.
Some 80% of stolen assets have been secured, a Binance spokesperson said on Friday, but the rest remains unaccounted for.
If the accusations are true, the record-making heist shows how powerful suspected North Korean hackers have become – a sign that the tools of the hacking trade have grown sharper.
Experts say the rise of artificial intelligence has also given threat actors new ways to carry out crime, through automation and other means.
In this case, it's plausible that AI was used to infiltrate Binance's systems.
As Chainalysis put it, the attacker used laundering patterns "we have not seen before".
