TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor

Three blockchain analytics firms have attributed this week's hack of Binance to North Korea, with two of the largest naming TraderTraitor, a North Korean hacking group, as responsible for what both describe as the largest crypto theft on record. >TRM Labs said it made the attribution "with high confidence," based on "robust on and off-chain intelligence." It put the theft at about $6.36 billion, moved out of Binance >wallets on 10 blockchains, most of it in about 20 minutes from 4:05 p.m. ET on Thursday. That is about four times the $1.5 billion Bybit hack of February 2025, which the FBI attributed to the same group, TRM noted. >Chainalysis, which put the total at about $6.4 billion, said the strongest evidence came when its investigators saw funds stolen from Binance commingling in real time with funds from last month's Bitget exploit, which had been attributed to North Korean actors. A Chainalysis spokesperson told CNN the firm had "high confidence" North Korea was behind the hack. Singapore-based Pangolin Intelligence also told CNN it believed a North Korean hacking unit was responsible, based on "analyzing the on-chain activity related to this hack and correlating with information gathered from previous known incidents." North Korea has previously denied hacking allegations. TRM and Chainalysis both said the attacker's operational wallet was funded through Tornado Cash, a crypto mixer. TRM said that and other features, including staging that began well before the theft, matched earlier North Korea-linked attacks such as the Bybit hack and April's KelpDAO exploit. On >

📌 Recommended Exchanges

OKX | Binance | Bybit | Bitget | Gate.io