Researchers Tie $6.3 Billion Binance Hack to North Korea's TraderTraitor

Blockchain analytics firms TRM Labs and Chainalysis, together with independent on-chain investigator ZachXBT, have attributed the $6.3 billion Binance hack to North Korea's TraderTraitor group. The converging assessments rest on on-chain fund-tracing and the group's known operational playbook.

TRM Labs said it assigned the attack to TraderTraitor with "high confidence," citing a combination of on-chain and off-chain intelligence. The firm did not publish the underlying evidence, so outside verification remains limited. Attribution in crypto investigations typically rests on infrastructure overlap and laundering patterns rather than direct identity proof.

Where do the on-chain links point?

ZachXBT provided the most concrete trail. He said funds stolen from Binance and from the earlier Bitget exploit were commingled at the same address after both streams moved through THORChain, a cross-chain liquidity protocol. "This indicates the same actor is likely behind both incidents," he said.

The Bitget attack, he noted, had already been attributed to TraderTraitor. If the commingling is confirmed, one entity would be responsible for both thefts — a combined exposure running well beyond the Binance figure alone. The detail matters operationally: THORChain's cross-chain design has repeatedly surfaced in laundering chains following large exploits.

What does Chainalysis say?

Chainalysis co-founder and CEO Jonathan Levin put the group's haul slightly above Binance's own estimate. "We assess Binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack," he said. The $100 million gap between his figure and the widely cited $6.3 billion impact estimate reflects differing accounting of stolen and recovered assets.

For scale, $6.4 billion exceeds the annual cybersecurity budget of most Fortune 100 firms. Levin framed the attribution as probabilistic — "likely," not certain — a caveat that applies to every claim in this case.

The new assessments build on an earlier read from Blockaid CEO Ido Ben-Natan, who told Cointelegraph shortly after the incident that its sophistication and on-chain preparation resembled North Korean activity. That preliminary view now has institutional backing from two of the largest analytics firms in the sector.

Who is TraderTraitor?

US authorities have linked the group to several of crypto's largest thefts, including the Bybit hack in February 2025. The FBI also joined US and Japanese investigators in attributing the theft of more than $300 million from DMM Bitcoin in May 2024 to the same North Korean actors.

According to the FBI, TraderTraitor typically compromises company employees through social engineering rather than exploiting protocol code. In the DMM case, an attacker posing as a recruiter sent a malicious coding test to an employee of wallet provider Ginco. Investigators said the resulting access was likely used to manipulate a legitimate transaction request and divert funds to attacker-controlled wallets.

That method carries a direct lesson for exchanges: the weakest point is not the chain but the person approving the transaction. Firms that do not harden insider approval workflows remain exposed to the same technique.

Separately, Bitget's CEO had earlier said he suspected North Korean involvement in the $352 million hack of his exchange, citing IP evidence — a hunch that ZachXBT's commingling finding now appears to corroborate.

What happens next?

Expect law enforcement coordination to intensify. The FBI's prior joint attribution with Japanese authorities on the DMM case offers a template, and a Binance loss of this size — roughly twenty times the DMM theft — makes similar multinational follow-through likely. Formal attribution by US agencies would be the next verifiable milestone.