Cybersecurity researchers from TRM Labs and Chainalysis, along with onchain investigator ZachXBT, have linked the $6.3 billion Binance hack to North Korea's TraderTraitor group.
TRM Labs attributed the attack to TraderTraitor with "high confidence," citing onchain and offchain intelligence. Chainalysis co-founder and CEO Jonathan Levin also pointed to the group, saying it stole $6.4 billion, slightly above Binance's estimated $6.3 billion impact.
Onchain investigator ZachXBT noted that funds stolen from Binance and an earlier Bitget exploit were commingled at the same address after moving through THORChain. "This indicates the same actor is likely behind both incidents," he said, with the Bitget attack previously attributed to TraderTraitor.
Blockaid CEO Ido Ben-Natan told Cointelegraph that the attack's sophistication and onchain preparations resembled North Korean activity, supporting the attribution.
Broader Pattern of Activity
US authorities have linked TraderTraitor to several major crypto thefts. The group was connected to the Bybit hack in February 2025, and the FBI joined US and Japanese investigators in attributing the theft of more than $300 million from DMM Bitcoin in May 2024 to the North Korean actors.
The FBI says TraderTraitor targets company employees through social engineering. In the DMM case, an attacker posing as a recruiter sent a malicious coding test to an employee of wallet provider Ginco. Investigators determined that the resulting access was likely used to manipulate a legitimate transaction request, diverting funds to attacker-controlled wallets.
