A warning from Google has alerted Binance founder Changpeng “CZ” Zhao to what appears to be an attempted hack by state-sponsored attackers – possibly linked to North Korea’s Lazarus Group, one of the most notorious hacking collectives in the world.
Zhao shared a screenshot of Google’s notification on X, joking that there was “nothing important” on his account but hinting that Lazarus might be behind the attempt. Cybersecurity analysts believe the message reflects a broader campaign of infiltration aimed at high-profile crypto figures.
Lazarus has become infamous for targeting cryptocurrency firms and executives across the globe. The same group is believed responsible for the $1.4 billion Bybit hack in February, the largest crypto theft in history. U.S. intelligence agencies say the organization funds the North Korean regime through stolen digital assets, often using fake developer identities and freelance work to gain internal access to exchanges.
According to intergovernmental blockchain adviser Anndy Lian, even senior government officials have received identical Google warnings in recent weeks. The alerts, he said, typically appear when hackers try to steal credentials through remote phishing or browser-based exploits.
The spike in attempted intrusions mirrors Zhao’s earlier warning about North Korean operatives posing as job seekers. In September, he cautioned that crypto companies were being infiltrated by applicants seeking roles in development and finance departments – a tactic now confirmed by the Security Alliance (SEAL), which exposed more than 60 fake IT worker profiles tied to the same network.
Recent investigations reveal that North Korean hackers stole over $1.3 billion in crypto during 2024, more than double the previous year’s total, according to Chainalysis. Attacks have ranged from data breaches at major exchanges like Coinbase to thefts from small DeFi startups.
Experts say the latest warning to CZ highlights the persistent vulnerability of the crypto industry. Analysts recommend stronger countermeasures – including AI-driven threat detection and dual-wallet security systems – as Lazarus continues to evolve its tactics.
Even for one of the most recognizable names in crypto, the message from Google is clear: no one is beyond the reach of state-backed hackers.
