North Korea Linked to $6.3B Binance Hack: Researchers

TRM Labs, Chainalysis and onchain investigator ZachXBT have linked the estimated $6.3 billion Binance hack to North Korea’s TraderTraitor group. TRM Labs said it had high confidence in the attribution based on onchain and offchain intelligence, while Chainalysis co-founder and CEO Jonathan Levin estimated the operation’s impact at $6.4 billion.

ZachXBT said funds stolen from Binance and the earlier Bitget exploit were commingled at the same address after moving through THORChain. He said the overlap indicated that the same actor likely carried out both incidents, noting that the Bitget attack had also been attributed to TraderTraitor.

The conclusion builds on an earlier assessment from Blockaid CEO Ido Ben-Natan, who said the attack’s sophistication and onchain preparations resembled activity associated with North Korean cybercriminals. US authorities have previously linked TraderTraitor to major crypto thefts, including the Bybit hack in February 2025 and more than $300 million taken from DMM Bitcoin in May 2024.

According to the FBI, TraderTraitor targets employees through social engineering. In the DMM Bitcoin case, an attacker posing as a recruiter sent a malicious coding test to an employee of wallet provider Ginco. Investigators said the resulting access was likely used to manipulate a legitimate transaction request and redirect funds to attacker-controlled wallets.