TRM and Chainalysis tie Binance $6.3B hack to North Korea's TraderTraitor

Multiple blockchain analytics firms have linked this week's Binance hack to North Korea, with two major entities naming TraderTraitor as responsible for what they describe as the largest crypto theft on record.

TRM Labs attributed the theft to "high confidence," based on "robust on and off-chain intelligence," estimating the loss at approximately $6.36 billion. This amount was moved from Binance wallets across 10 blockchains, primarily within about 20 minutes starting at 4:05 p.m. ET on Thursday.

Chainalysis placed the total amount at roughly $6.4 billion. Their strongest evidence involved observing Binance funds mixing in real time with proceeds from last month's Bitget exploit, which had been attributed to North Korean actors.

Binance has stated it has set aside over $6.34 billion of its own capital to compensate users for the losses, with $5 billion of that already held in the specific tokens that were taken.

Both TRM and Chainalysis noted that the attacker's operational wallet was financed via Tornado Cash, a cryptocurrency mixer. TRM further indicated that the operational staging preceding the theft matched earlier North Korea-linked incidents, such as the Bybit hack and the April KelpDAO exploit.

In the case of Ethereum, TRM detailed that the attacker utilized an EIP-7702 delegation feature, allowing an ordinary wallet to execute smart contract code, to transform a Binance hot wallet into a controlled sweeper, supported by 50 pre-signed authorizations.

Binance has indicated its investigation initially focused on a compromised engineer's laptop but has since discovered "additional points of breach." The Bybit attack, which the FBI attributed to the same group, also originated from one compromised machine, where North Korean hackers planted malicious code in the infrastructure of the Safe wallet provider after compromising a developer's computer.

Market participants have seen significant asset freezing; Tether, Circle, Ripple, and World Liberty Financial have frozen about $2.67 billion in stablecoins, while Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB. Binance reports the total frozen amount is about $3 billion.

These developments reflect ongoing regulatory and investigative scrutiny regarding illicit finance within the digital asset space, as evidenced by the U.S. Treasury sanctioning 10 individuals and one entity over North Korean IT worker schemes moving millions in crypto.

Why it matters

This incident highlights the persistent and sophisticated threat posed by state-sponsored hacking groups in the crypto space. Regulators and exchanges are facing increased pressure to secure infrastructure against advanced actors like TraderTraitor. The scale of the loss underscores the ongoing risk profile for major digital asset platforms.