Changpeng Zhao Warned Of State-Backed Hack, Mentions ‘Lazarus’ Threat

Changpeng Zhao (CZ), the founder of Binance, posted a grave security warning on October 10, 2025. Google alerted him to the possibility of a password theft attempt by a government-backed attacker.

CZ joked that there was nothing significant in his Google account when he posted the warning on X (formerly Twitter). However, the warning was severe.

Only a few weeks had passed since CZ issued a warning regarding North Korean hackers impersonating IT professionals. By applying for remote jobs, these hackers have been attempting to infiltrate cryptocurrency companies.

CZ’s post reignited concerns about the Lazarus Group, a North Korean cybercrime unit known for targeting cryptocurrency platforms. Google sends these alerts only when it detects highly sophisticated threats.

CZ said he receives them occasionally, but this one felt different. It highlighted a growing pattern of attacks on cryptocurrency leaders and platforms.

Lazarus Group: A Persistent Threat

The Lazarus Group is believed to be behind many major crypto heists. They allegedly stole more than $2 Billion worth of digital assets in 2025 alone. Phishing, malware, and social engineering techniques, such as impersonation, are among their strategies.

To obtain access to internal systems, they frequently pretend to be developers or IT specialists. According to experts, Lazarus is now focusing on individual executives rather than just exchanges.

This signifies a change in approach. They attempt to provide important individuals with access to private information rather than targeting platforms directly.

This pattern applies to CZ’s warning. He is a highly sought-after target because he is one of the most influential figures in the cryptocurrency industry. His warning demonstrates that these dangers can still affect even the most powerful people.

Security researchers have also discovered malware tools such as PylangGhost. These tools imitate well-known companies like Robinhood and Coinbase.

They pilfer login credentials from cryptocurrency wallets and browser extensions. Recent campaigns have identified more than 80 tools.

Crypto Industry Responds

CZ’s post received a swift response from the crypto community. Numerous professionals shared similar experiences. Some claimed to have gotten Google alerts as well. Others reported phishing emails and dubious job applications.

Cybersecurity experts advised cryptocurrency companies to strengthen their defenses. They suggested employee training, frequent password changes, and multi-factor authentication. Prominent individuals were advised to avoid using public Wi-Fi and instead use secure devices.

U.S. authorities have taken notice too. In June 2025, the Department of Justice charged four North Koreans for stealing nearly $900,000 through fake remote jobs. These operatives used falsified résumés and LinkedIn profiles to secure employment with U.S. cryptocurrency companies.

The Security Alliance (SEAL) reported that at least 60 North Korean agents had infiltrated crypto firms this way. They worked as developers, analysts, and support staff. Some stayed undetected for months.

CZ’s warning adds urgency to these findings. It shows that the threat is not theoretical. It is happening now, and it is targeting the industry’s top players.