The $6.3 billion security breach involving cryptocurrency exchange Binance has been linked to North Korea’s TraderTraitor hacking group by blockchain intelligence firm TRM Labs, Chainalysis and onchain investigator ZachXBT. Their assessments point to connections between the stolen funds and previous cryptocurrency thefts attributed to North Korean cyber actors.
TRM Labs said it had high confidence in its attribution, citing a combination of onchain and offchain intelligence. The firm estimated that approximately $6.36 billion in digital assets was moved from Binance wallets across 10 blockchains during the incident.
The different estimates reflect separate assessments of the stolen assets. Binance's estimated impact was approximately $6.3 billion, while Chainalysis co-founder and CEO Jonathan Levin cited a figure of $6.4 billion. These figures should not be treated as separate confirmed losses.
Blockchain Investigators Point to TraderTraitor
TRM Labs directly attributed the attack to TraderTraitor, describing the group as a North Korean hacking unit. Its investigation cites blockchain transactions and additional intelligence as the basis for its assessment.
ZachXBT identified another connection through the movement of stolen funds. He said assets taken during the Binance incident and an earlier Bitget exploit were commingled at the same address after passing through THORChain. He argued that the overlap indicates the same actor may be responsible for both incidents.
The earlier Bitget attack had also been attributed to TraderTraitor. However, the shared address and transaction routes are investigative indicators, not by themselves conclusive proof of the identity of the attacker.
Chainalysis Identifies Links to Earlier Attacks
Chainalysis CEO Jonathan Levin also pointed to TraderTraitor as the likely group behind the Binance incident. In a statement shared on X, Levin said:
“We assess Binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack.”
Levin's estimate was slightly higher than Binance's reported $6.3 billion impact. His assessment adds to the growing body of blockchain intelligence linking the incident to North Korean cyber operations.
The attribution is consistent with previous investigations involving TraderTraitor. The FBI's February 2025 announcement identified North Korea as responsible for the approximately $1.5 billion Bybit hack and referred to the activity as TraderTraitor.
Previous Cryptocurrency Thefts Linked to North Korean Actors
TraderTraitor has been associated with several major cryptocurrency theft investigations. In May 2024, North Korean cyber actors stole approximately $308 million from Japanese cryptocurrency company DMM Bitcoin. The FBI, the US Department of Defense Cyber Crime Center and Japan's National Police Agency attributed the theft to actors tracked as TraderTraitor.
The FBI's DMM Bitcoin investigation described a social engineering operation targeting an employee of Ginco, a Japanese cryptocurrency wallet software provider.
In that case, an attacker posing as a recruiter contacted the employee through LinkedIn and sent a malicious Python script disguised as a pre-employment coding test. The employee copied the code to a personal GitHub page and was subsequently compromised. Investigators said the attackers later used access to the employee's communications system to manipulate a legitimate transaction request, resulting in the loss of 4,502.9 BTC, valued at approximately $308 million at the time.
The earlier Bybit incident also demonstrates the scale of cryptocurrency thefts attributed to the group. The FBI's public alert encouraged exchanges, blockchain services, bridges and other industry participants to identify and block transactions connected to the stolen assets.
How TraderTraitor Targets Cryptocurrency Companies
The FBI has described TraderTraitor's operations as involving targeted social engineering against employees of cryptocurrency and blockchain companies. Rather than relying exclusively on direct attacks against blockchain infrastructure, these operations can exploit people and their access to company systems.
The US government's cybersecurity advisory on TraderTraitor outlines tactics used to target organizations in the cryptocurrency sector. These include attempts to persuade employees to download malicious applications or files that can provide attackers with access to company systems.
The DMM Bitcoin case illustrates how compromised employee access can potentially be used to interfere with legitimate financial processes. It also highlights why employee security, access controls and transaction verification are important safeguards for cryptocurrency businesses.
What Happens Next in the Binance Investigation?
The Binance incident attribution remains an assessment by blockchain investigators. TRM Labs has expressed high confidence in its conclusion, while Chainalysis and ZachXBT have identified additional connections to previous attacks. The available information does not establish that a final public determination has been made by law enforcement.
Further analysis of wallet movements, transaction routes and links to previously identified attacker addresses may provide additional evidence. The connection identified through THORChain and the earlier Bitget exploit is one area investigators are examining.
For cryptocurrency exchanges and other service providers, the incident reinforces the importance of monitoring suspicious wallet activity and screening transactions connected to known threat actors. The findings from the Binance investigation may also add to the information used by security teams to identify and disrupt future attempts to move stolen digital assets.
