Blockchain analytics firms including Chainalysis and TRM Labs have attributed the October 29 theft of funds from Binance hot wallets to TraderTraitor, a unit of the North Korean state-sponsored Lazarus Group. The incident, described by the firms as the largest crypto theft to date, is estimated in the range of roughly $6.3 billion to $6.4 billion.
Chainalysis said it began investigating the exploit in coordination with industry partners and was monitoring funds moving across multiple blockchains, including Bitcoin, Ethereum, Tron and a number of layer-2 networks.
Chainalysis cites link to earlier Bitget exploit
Chainalysis CEO Jonathan Levin said the analysis linked the theft to TraderTraitor, pointing to the commingling of funds with last month's Bitget exploit as a basis for the assessment.
"We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance," Chainalysis said. Levin added that industry partners had frozen nearly $3 billion, with Chainalysis continuing to track the remaining funds.
TRM Labs describes a 20-minute sweep
TRM Labs also blamed TraderTraitor, stating that $6.36 billion was moved from Binance hot wallets across 10 blockchains in about 20 minutes.
Citing what it described as on-chain and off-chain intelligence, TRM Labs said the attacker used Ethereum's EIP-7702 to convert a Binance wallet into a sweeper under their control. According to the firm, the hackers prepared 50 pre-signed authorizations in advance and executed them on other chains during the same 20-minute window.
TRM Labs highlighted matching patterns with earlier incidents, noting that TraderTraitor has been tied to the $1.5 billion Bybit hack in 2025 and the KelpDAO hack in April 2026. The firm said almost $2.8 billion in stablecoins and other assets were frozen by issuers including Tether and Circle.
Investigators point to shared infrastructure
On-chain investigator ZachXBT reported that stolen funds from the Binance hack and the earlier $388 million Bitget exploit were commingled at the same address after arriving via THORChain, indicating the same actor was likely behind both incidents.
Separately, on-chain monitor Onchain Lens reported that the attacker moved 17.26K ETH, valued at about $38.82 million, to a new wallet in preparation for laundering funds through Tornado Cash and other mixers. The monitor added that the attacker still held 480.72K ETH, worth roughly $1.08 billion, that could not be frozen.
