Blockchain investigators have attributed the $6.3 billion Binance hack to North Korea's Tradertraitor unit, a sub-group of the larger Lazarus ecosystem. TRM Labs and independent investigator ZachXBT reached this conclusion with high confidence based on onchain and offchain intelligence.
No government has formally named a culprit, and the investigators' assessments do not automatically confirm responsibility. However, TRM Labs' analysis compared the attack's staging and signature patterns to the Bybit theft from early the prior year, which the FBI attributed to the same group, as well as the Kelpdao hack in April 2026.
Stolen Assets and Laundering Activity
Binance reported that approximately $3 billion in stolen funds have been frozen. However, TRM Labs estimates the attacker still holds more than 420,000 ETH and 18,270 BTC, valued at approximately $2.4 billion beyond issuers' reach.
The attacker has employed several laundering methods. TRM Labs reported the sale of approximately 325 million USDT to market makers for roughly 122,300 ETH at a discount exceeding 10 percent. Additionally, approximately 19,760 ETH were borrowed on Aave against 60 million USDT. Bitcoin has moved through a peel chain, a method that splits funds into smaller transfers.
TRM Labs expects the next laundering stage to involve cross-chain bridges, swap services, and over-the-counter brokers.
Context and Scale
The Binance hack represents the largest cryptocurrency theft on record. Chainalysis separately estimated approximately $5.912 billion was stolen, making it nearly four times the size of the Bybit theft.
The incident occurs during what Defillama describes as the most hacked year in crypto history, with over $8 billion stolen in 2026 compared to $2.87 billion across nearly 150 incidents in 2025.
Response and Investigation
TRM Labs is alerting partners through its Beacon Network and has urged exchanges to screen deposits against labeled attacker addresses. Binance has promised a detailed technical post-mortem upon completion of its preliminary investigation.
