Changpeng Zhao, known as CZ, the founder of Binance, shared a disturbing notification from Google today. The tech giant warned him of a potential state-sponsored hack attack that could target his account. The case sheds light on the growing cyber threat faced by leading figures in the cryptocurrency industry. In the shadow stands a group of hackers from North Korea.
Security alert from Google – who wanted to take over the Binance founder’s account?
CZ published a screenshot with a security warning on its official X account. In his typical style, he asked his followers if anyone else had received a similar notification and who might be behind it.
I get this warning from Google every now and then. Does anyone know what this is? Lazarus from North Korea? Not that I had anything important going on. But stay SAFU
– wrote CZ, referring to Binance’s well-known slogan regarding the safety of users’ funds.
Google regularly monitors and notifies users about potential state-sponsored cyber threats, especially those targeting high-ranking individuals in the cryptocurrency sector. The giant systematically warns about the risk of phishing and fake websites impersonating legitimate platforms to defraud cryptocurrency users.
Suspicion? Lazarus Group supported by North Korea
CZ immediately pointed to the main suspect – the Lazarus hacker group, known for being sponsored and supported by the North Korean regime. And this is not an unfounded suspicion.
Lazarus is one of the oldest and most dangerous hacker groups operating in the cryptocurrency space. Since 2017, it has stolen over $6 billion in digital assets. Moreover, there are many indications that the stolen assets, later properly laundered, were used to finance the Pyongyang regime’s nuclear program.
The group has evolved over the years, becoming more sophisticated, using phishing, social engineering and other methods to compromise large cryptocurrency platforms.
2025 turned out to be a record year for cybercriminals – over USD 2 billion has already been stolen, almost three times more than the previous annual record of USD 1.35 billion set in 2022. This list includes the largest cryptocurrency theft in history: the Bybit attack in February, in which $1.5 billion was lost.
New tactics = increasingly perfidious attacks
The founder of Binance recently shared insights into the advanced tactics used by North Korean hackers. Criminals impersonate recruiters or job candidates to gain access to sensitive positions in the development, security or finance departments of cryptocurrency companies.
State-sponsored hacking groups often use tactics such as impersonating job applicants or employers to infiltrate companies, according to the latest cybersecurity warning. These government-backed attackers often target cryptocurrency exchanges and industry leaders. Social engineering that Kevin Mitnick would be proud of.
What’s more, Lazarus hackers have begun using artificial intelligence to create deepfakes, making their attacks even more difficult to detect. CZ recently warned against fake recruitment applications that serve as an entry point for cybercriminals.
The community responds – practical safety tips
In response to CZ’s post, user Crypto Jargo explained that such warnings from Google are rare and usually go to journalists, researchers or people associated with sensitive topics.
“This doesn’t always mean a real attack, but it’s better to be safe than sorry,” wrote the user, recommending that the Binance founder should:
- He changed his password to a new one
- Enabled two-factor authentication (2FA) using an authenticator app instead of SMS
- Checked to see if any suspicious devices were logged in
This is the standard ABC of cybersecurity, which is recommended to everyone – not only representatives of the cryptocurrency industry 😉
The crypto industry in the shadow of cyber threats
Google’s warning highlights how top digital asset industry leaders face increasingly sophisticated cyber threats from state-sponsored hackers seeking to exploit the industry.
Attacks on cryptocurrency platforms and their leaders have become much more intensified. In 2025, we see a shift from traditional stock market attacks towards targeting high net worth individuals through social engineering. This means that no one in the industry (even the most seasoned veterans like Binance’s founder) can feel completely safe.
CZ’s case is another reminder that in the cryptocurrency world, cybersecurity is not an option, but an absolute necessity. Stay SAFU – as the founder of Binance himself advises.
