TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor

TRM Labs and Chainalysis have both attributed the Binance hack to TraderTraitor, the North Korean group the FBI blamed for the $1.5 billion Bybit hack.

Chainalysis said it saw Binance funds commingling with proceeds of last month's Bitget exploit, which had been attributed to North Korean actors.

Binance said it has reserved more than $6.34 billion of company funds to cover losses, $5 billion of it already held in the affected tokens.

Three blockchain analytics firms have attributed this week's hack of Binance to North Korea, with two of the largest naming TraderTraitor, a North Korean hacking group, as responsible for what both describe as the largest crypto theft on record.

TRM Labs said it made the attribution "with high confidence," based on "robust on and off-chain intelligence." It put the theft at about $6.36 billion, moved out of Binance wallets on 10 blockchains, most of it in about 20 minutes from 4:05 p.m. ET on Thursday. That is about four times the $1.5 billion Bybit hack of February 2025, which the FBI attributed to the same group, TRM noted.

Chainalysis, which put the total at about $6.4 billion, said the strongest evidence came when its investigators saw funds stolen from Binance commingling in real time with funds from last month's Bitget exploit, which had been attributed to North Korean actors.

A Chainalysis spokesperson told CNN the firm had "high confidence" North Korea was behind the hack. Singapore-based Pangolin Intelligence also told CNN it believed a North Korean hacking unit was responsible, based on "analyzing the on-chain activity related to this hack and correlating with information gathered from previous known incidents." North Korea has previously denied hacking allegations.

TRM and Chainalysis both said the attacker's operational wallet was funded through Tornado Cash, a crypto mixer. TRM said that and other features, including staging that began well before the theft, matched earlier North Korea-linked attacks such as the Bybit hack and April's KelpDAO exploit.

How the attack worked

On Ethereum, the attacker used an EIP-7702 delegation, a feature introduced in Ethereum's Pectra upgrade that lets an ordinary wallet run smart contract code, to turn a Binance hot wallet into a sweeper it controlled, with 50 pre-signed authorizations prepared in advance, according to TRM. Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers. In TRM's assessment, that points to a compromise of Binance's hot wallet signing infrastructure.

Binance has said its investigation began with a compromised engineer's laptop, but has since uncovered "additional points of breach." The Bybit attack also began with a single compromised machine: North Korean hackers planted malicious code in the infrastructure of wallet provider Safe after compromising a Safe developer's computer, Decrypt reported at the time.

The attacker has moved quickly to launder what it could not keep. Chainalysis said it is seeing "never-seen-before laundering patterns," with thousands of transactions in a short period suggesting the use of automation to circulate funds repeatedly among addresses. The attacker also sold USDT to market makers and borrowed ETH against USDT on lending protocol Aave to race issuers' freezes, according to TRM, and now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer's reach.

Tether, Circle, Ripple and World Liberty Financial have frozen about $2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB, TRM said. Binance puts the total frozen at about $3 billion.

In an update on Friday, Binance said it has reserved more than $6.34 billion of company funds to cover the incident, $5 billion of which is already held in the exact tokens that were stolen. It is buying the rest through market and over-the-counter channels, which "can take longer because some tokens may have low liquidity," the exchange said. Those figures do not include frozen assets.

"We will weather this storm," Binance said.