North Korea Binance Hack: TRM, Chainalysis Name TraderTraitor

Two of the largest blockchain analytics firms now say the North Korea Binance hack was the work of TraderTraitor, the same group the FBI blamed for the $1.5 billion Bybit theft in February 2025. By October 30, 2026, TRM Labs and Chainalysis had both named the group. The attribution came a day after an attacker drained roughly $6.4 billion from Binance wallets in what both firms describe as the largest crypto theft on record.

A third firm, Singapore-based Pangolin Intelligence, also pointed to North Korea. Elliptic, however, notes that no government has made an official attribution so far.

What we know about the North Korea Binance hack

According to TRM Labs, about $6.36 billion left Binance wallets on 10 blockchains on Thursday, October 29, most of it in roughly 20 minutes starting at 4:05 p.m. ET. Estimates vary slightly by firm. Chainalysis puts the total near $6.4 billion, Elliptic’s analysis lands on $6.43 billion, and Binance itself estimates about $6.3 billion.

Elliptic says Ethereum took the heaviest hit: $3.80 billion across 186 tokens, including 1.9 billion USDT and 823 million USDC.

How investigators linked the North Korea Binance hack to TraderTraitor

TRM said it made its attribution “with high confidence” based on on-chain and off-chain intelligence. Chainalysis pointed to its strongest clue: Binance funds commingling in real time with proceeds of last month’s Bitget exploit, which had already been tied to North Korean actors. Chainalysis CEO Jonathan Levin wrote that the attack was “likely done by DPRK group TraderTraitor,” SecurityWeek reported.

On-chain sleuth ZachXBT identified funds from the Binance and Bitget hacks converging at the same address, Cointelegraph noted. According to Decrypt, that overlap led him to believe the same North Korean group was behind both attacks. Pangolin Intelligence told CNN it believed a North Korean hacking unit was responsible. North Korea has previously denied hacking allegations.

The attack method

Both TRM and Chainalysis said the attacker’s operational wallet was funded through the Tornado Cash mixer. TRM added that this, plus staging that started well before the theft, matched earlier North Korea-linked attacks such as Bybit and April’s KelpDAO exploit.

On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper, with 50 pre-signed authorizations prepared in advance. EIP-7702 is a Pectra upgrade feature that lets an ordinary wallet run smart contract code. On the other nine chains, funds moved through ordinary signed transfers. TRM reads that as a compromise of Binance’s hot wallet signing infrastructure. Binance has said its probe began with an engineer’s compromised laptop and has since found “additional points of breach.” For earlier context, see our report on how the Binance hack happened.

What is still unclear

The private-sector attributions have not yet been matched by any government statement. In the Bybit case, it was the FBI that formally attributed the attack to TraderTraitor.

Binance says it has reserved more than $6.34 billion of company funds to cover losses, $5 billion of it already held in the affected tokens. As Reuters reported, the exchange hasn’t said where that money came from.

Then there’s the laundering. Chainalysis says it’s seeing “never-seen-before laundering patterns,” with thousands of transactions in a short period that suggest automation is being used to cycle funds between addresses. TRM said the attacker sold USDT to market makers and borrowed ETH against USDT on Aave to beat issuer freezes. TRM says the attacker now holds more than 420,000 ETH and 18,270 BTC.

How markets and analysts reacted

Prices slid after the theft. Decrypt reported that BTC fell 3.6% to around $77,500 and ETH dropped 4% to $2,235 after the hack. By 14:13 UTC on Friday, both traded lower still, as the CoinGecko snapshot below shows. More on the market moves is in our earlier coverage of the Binance hack market impact.

BNB posted the largest 24-hour drop of the five assets in the table. The Crypto Fear & Greed Index read 30 (“Fear”) on October 30. For scale, Binance held roughly $144 billion in assets before the hack, according to DefiLlama data cited by CoinDesk.

What it means for investors

Binance has temporarily suspended deposits and withdrawals for security checks and expects withdrawals to resume by Sunday morning, CNN reported. Updates on the pause are in our coverage of Binance withdrawals being paused. The exchange says it has begun recovering affected assets for users, but timelines can shift.

The broader lesson is about custody risk. Funds held on any exchange depend on that platform’s security and solvency. Binance’s pledge to cover losses is a company commitment, so users should rely on the exchange’s official announcements for details. Volatility after events like this can be sharp, and leveraged positions can be wiped out quickly. High-profile hacks also tend to attract phishing and fake “recovery” offers. No legitimate service will ask for a seed phrase.

The next milestones are a possible attribution by the FBI or another government, and how much of the roughly $2.4 billion in ETH and BTC moves through laundering channels. Binance’s planned withdrawal restart by Sunday is the other near-term test.

Bottom line

Several analytics firms agree on who’s behind the North Korea Binance hack, even without official confirmation. Binance puts frozen funds at about $3 billion, but the effort to trace the remaining ETH and BTC is still under way.

Sources

• TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor (Decrypt)
• North Korea’s TraderTraitor linked to $6.3B Binance hack (Cointelegraph)
• Blockchain intelligence firms link North Korea to $6.3B hack on Binance : NPR (www.npr.org)
• $6 Billion Binance Hack Bears Hallmarks of North Korea's TraderTraitor – SecurityWeek (www.securityweek.com)
• The largest theft in history: North Korea likely behind the $6.4 billion Binance hack (www.elliptic.co)
• Hackers steal $6.3 billion from Binance in record heist blamed on North Korea (Reuters via Yahoo Finance) (finance.yahoo.com)
• Binance loses over $6 billion in the largest crypto hack to date – CoinDesk (www.coindesk.com)
• Binance: North Korea suspected in record $6 billion theft from world's largest crypto exchange – CNN (www.cnn.com)
• Binance probes possible $5.7 billion crypto hack (Yahoo Finance) (finance.yahoo.com)
• Morning Minute: Binance's $6.4B Hack Overshadows Hyperliquid's Biggest Day – Decrypt (decrypt.co)

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.