High-net-worth crypto industry individuals, including former Binance CEO Changpeng Zhao (CZ), have emerged as key targets for state-backed attackers in a record-breaking year for digital asset theft.
In 2025 alone, losses from exchanges and wealthy individuals have reached billions, prompting widespread alarm over escalating state-sponsored cyber threats.
Google Warns CZ of a State-Backed Attack — Is North Korea Behind It?
In a recent X post, Changpeng Zhao (CZ), the former CEO of Binance, publicly disclosed a security alert from Google. The alert indicated a potential attempt by government-backed attackers to compromise his account.
Zhao noted that the alert occurs sporadically, prompting responses from the community. Crypto analyst Neel Kukreti described it as a rare Google notification typically reserved for individuals handling sensitive information. These include journalists or researchers.
“It’s not always a real hack, but better safe than sorry. You’re probably fine, but it’s good practice to stay locked down these alerts don’t show up for nothing,” he stated.
Furthermore, Google describes these alerts as cautionary. According to the company’s blog, these notifications have been issued since 2012 as precautionary measures when evidence suggests government-backed attack attempts.
“The notice reflects our assessment that a government-backed attacker has likely attempted to access the user’s account or computer through phishing or malware, for example,” Google clarified.
They are sent in batches to at-risk users and do not imply actual compromise or identify the specific government involved.
North Korean Hackers Drive Record-Breaking Crypto Heists in 2025
Meanwhile, CZ speculated that the Lazarus Group — a state-sponsored hacking collective operating under North Korea’s Reconnaissance General Bureau — could be behind the attack attempt. The group is notorious for targeting cryptocurrency firms and services. It was also responsible for the massive Bybit hack earlier this year.
Nonetheless, Zhao’s speculation might not be misplaced. According to security firm Elliptic, North Korean hackers are no longer limiting their focus to exchanges and companies but have started targeting wealthy crypto individuals.
“As crypto prices have risen, individuals have become increasingly attractive targets, often lacking the security measures employed by businesses. Some of these individuals are also targeted due to their association with businesses holding large amounts of cryptoassets, which the hackers are looking to steal,” the report reads.
The growing focus on individual investors reflects a broader escalation in North Korea’s cyber operations this year. In 2025, North Korean hackers stole over $2 billion in cryptocurrency assets.
According to Elliptic, this represents the highest annual total to date, lifting the regime’s cumulative known haul to over $6 billion. Officials widely believe these funds support North Korea’s military programs.
“The thefts are a record for the regime-linked hackers who now account for around 13% of North Korea’s gross domestic product (GDP), according to United Nations’ estimates,” BBC reported.
North Korean Crypto Theft in 2025. Source: Elliptic
With losses growing, crypto professionals and investors face urgent calls to strengthen digital protections. High-profile incidents like CZ’s Google alert demonstrate that even the most prominent in crypto remain vulnerable to sophisticated, state-linked adversaries.
