ZachXBT

Hackers attempted to infiltrate the account of Binance co-founder Changpeng “CZ” Zhao, signaling potential attacks from state-backed hacker groups, such as the North Korean Lazarus Group.
“Government-backed attackers” were attempting to steal Zhao’s Google password, according to a Google warning shared by CZ, who suggested that it may be another attempt by North Korea’s <a href="https://cointelegraph.com/learn/articles/lazarus-group-hackers-behind-billion-dollar-heists" rel="noopener noreferrer nofollow">Lazarus Group</a>.
“I get this warning from Google once in a while. Does anyone know what this is? North Korea Lazarus? Not that I have anything important on my account,” said Zhao in a Friday X <a href="https://x.com/cz_binance/status/1976508825227157887" rel="noopener noreferrer nofollow" target="_blank">post</a>.
The infamous <a href="https://cointelegraph.com/people/top-people-in-crypto-and-blockchain-2023/lazarus-group/" rel="noopener noreferrer nofollow">North Korean Lazarus Group</a> is the main suspect behind some of the most devastating cryptocurrency exploits, including the <a href="https://cointelegraph.com/news/bybit-exchange-hacked" rel="noopener noreferrer nofollow">$1.4 billion</a> Bybit hack, the industry’s largest to date, which occurred on Feb. 21.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2025-10/0199cdf9-fee5-7e45-b17c-df01dd127074" title="" alt="CZ’s Google account targeted by ‘government-backed’ hackers">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/cz_binance/status/1976508825227157887" rel="noopener noreferrer nofollow" target="_blank">Changpeng Zhao</a>
 </figcaption>
</figure>
US intelligence reports highlight a “sophisticated network of agents posing as remote IT workers, which has funneled significant funds back to Pyongyang,” Anndy Lian, author and intergovernmental blockchain adviser, told Cointelegraph, adding:
<blockquote>
 “I personally know that a government official who got a similar prompt as CZ, saying that his account is detected with government-backed hackers trying to steal his password.”
</blockquote>
“They tried to contact Google for more information, but nothing was given due to security reasons,” he said.
Related: <a href="https://cointelegraph.com/news/bybit-hackers-solana-memecoin-scams-zachxbt" rel="noopener noreferrer nofollow">Bybit hackers may be behind Solana memecoin scams — ZachXBT</a>
<h2 id="zhao-sounds-alarm-on-growing-threat-of-north-korean-impersonators">Zhao sounds alarm on growing threat of North Korean impersonators</h2>
The attempted breach follows a period of renewed threats from North Korean hackers. It comes three weeks after <a href="https://cointelegraph.com/news/cz-crypto-seal-60-north-korean-hackers" rel="noopener noreferrer nofollow">Zhao sounded the alarm</a> on the growing threat of North Korean hackers seeking to infiltrate crypto companies through employment opportunities and bribes.
“They pose as job candidates to try to get jobs in your company. This gives them a “foot in the door,” specifically for employment opportunities related to development, security and finance, wrote Zhao in a Sept. 18 X <a href="https://x.com/cz_binance/status/1968533125929058454" rel="noopener noreferrer nofollow" target="_blank">post</a>.
Zhao’s warning came as a group of ethical hackers called Security Alliance (SEAL) compiled the profiles of at least 60 North Korean agents posing as IT workers under fake names seeking to infiltrate US crypto exchanges and steal sensitive user data.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2025-09/01998590-a9ef-785f-b59d-e16a10c09177" title="" alt="CZ’s Google account targeted by ‘government-backed’ hackers">
 <figcaption style="text-align: center;">
 SEAL team repository of 60 North Korean IT worker impersonators. Source: lazarus.group/team
 </figcaption>
</figure>
Related: <a href="https://cointelegraph.com/news/coinbase-tightens-workforce-security-after-north-korea-remote-worker-threats" rel="noopener noreferrer nofollow">Coinbase tightens workforce security after North Korea remote-worker threats</a>
Coinbase suffered <a href="https://cointelegraph.com/news/coinbase-breach-physical-crime-techcrunch-founder" rel="noopener noreferrer nofollow">a data breach</a> in May that exposed sensitive information from less than 1% of the exchange’s transacting monthly users.
The data breach may cost the <a href="https://cointelegraph.com/news/cyber-criminals-steal-coinbase-customer-data-20-m-ransom" rel="noopener noreferrer nofollow">exchange up to $400 million</a> in reimbursement expenses, Cointelegraph reported on May 15.
Later in June, four North Korean operatives infiltrated multiple crypto firms as freelance developers, stealing a cumulative <a href="https://cointelegraph.com/learn/articles/how-4-north-korean-agents-stole-900k-from-a-us-crypto-startup" rel="noopener noreferrer nofollow">$900,000 from these</a> startups.
Throughout 2024, North Korean hackers stole over $1.34 billion worth of digital assets across 47 incidents, a 102% increase from the $660 million stolen in 2023,&nbsp;<a href="https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2025/" rel="noopener noreferrer nofollow" target="null">according</a>&nbsp;to Chainalysis data.
<a href="https://cointelegraph.com/news/crypto-dual-wallet-ai-monitoring-for-north-korean-hackers" rel="noopener noreferrer nofollow">Cryptocurrency companies need</a> to strengthen their security measures against these attackers by implementing dual wallet management and real-time artificial intelligence threat monitoring, according to cybersecurity experts.<iframe width="100%" height="315" src="https://www.youtube.com/embed/NDv0RfehETQ?start=" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen loading="lazy" sandbox="allow-scripts allow-same-origin allow-popups allow-forms"></iframe>
Magazine: <a href="https://cointelegraph.com/magazine/rwa-hail-mary-china-thai-big-secret-crypto-hack-asia-express/" rel="noopener noreferrer nofollow">Thailand’s ‘Big Secret’ crypto hack, Chinese developer’s RWA tokens: Asia Express</a>

CZ’s Google account targeted by ‘government-backed’ hackers

Table of Contents

Cointelegraph

Other articles published on Oct 10, 2025

Join our free newsletter for daily crypto updates!