In what marks a monumental milestone in financial cybercrime, leading cybersecurity researchers from TRM Labs and Chainalysis, alongside prominent onchain investigator ZachXBT, have officially linked the unprecedented $6.3 billion Binance hack to North Korea’s notorious state-sponsored cyberespionage and theft collective, known as TraderTraitor. The attribution comes as a consensus builds across the digital asset security community, pointing firmly toward Pyongyang-backed actors as the masterminds behind the largest cryptocurrency heist in history.
TRM Labs was among the first to publicly attribute the devastating breach to the TraderTraitor syndicate with what it described as "high confidence." The intelligence firm based its definitive assessment on a comprehensive analysis of both onchain transactional flows and offchain intelligence gathered in the wake of the incident. This conclusion quickly gained traction across the broader cybersecurity landscape as additional industry leaders began corroborating the findings through independent forensic investigations.
Adding critical weight to the attribution, onchain investigator ZachXBT uncovered a definitive operational link between the Binance compromise and an earlier exploit involving the Bitget exchange. According to ZachXBT, funds stolen during the massive Binance hack and the previous Bitget exploit were deliberately commingled at the exact same destination address after being obfuscated and routed through the THORChain decentralized liquidity protocol.
"This indicates the same actor is likely behind both incidents," ZachXBT stated, noting further that the preceding Bitget attack had already been widely attributed to the same North Korean collective. The convergence of stolen assets into shared laundering infrastructure provides a compelling digital signature that heavily implicates a singular, unified threat group operating across multiple high-profile vectors.
This assessment was further reinforced by Jonathan Levin, the co-founder and CEO of blockchain analytics titan Chainalysis. Levin publicly pointed the finger at TraderTraitor, noting that his firm’s tracking indicates the group may have actually absconded with approximately $6.4 billion, a figure slightly higher than Binance’s initial estimated impact of $6.3 billion.
"हम assess Binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack," Levin stated in a public post, underscoring how cross-chain tracking and historical behavioral analysis continue to unmask state-backed cyber operations.
The widespread consensus among top-tier investigators follows an earlier evaluation put forward by Blockaid CEO Ido Ben-Natan. In initial statements to industry media shortly after the incident, Ben-Natan observed that the technical sophistication, structural execution, and meticulous onchain preparations of the Binance attack bore an uncanny resemblance to established operational patterns traditionally deployed by North Korean threat actors.
United States law enforcement and international intelligence agencies have long tracked TraderTraitor, linking the collective to a string of the cryptocurrency sector’s largest and most damaging thefts. Among these is the high-profile Bybit hack that occurred in February 2025, which also drew intense scrutiny from federal regulators and private security contractors alike. Furthermore, the Federal Bureau of Investigation previously joined forces with US and Japanese investigators to formally attribute the theft of more than $300 million from DMM Bitcoin in May 2024 to the same North Korean operatives.
Investigative findings shared by the FBI reveal that TraderTraitor and affiliated North Korean state hackers frequently rely on sophisticated social engineering tactics to breach corporate defenses and target employees of cryptocurrency platforms, wallet providers, and financial institutions. In the DMM Bitcoin case, for instance, an attacker meticulously posed as a corporate recruiter and transmitted a malicious coding test to an unsuspecting employee working for wallet provider Ginco. Investigators concluded that the initial remote access and credentials obtained through this deceptive maneuver were subsequently weaponized to manipulate a legitimate transaction request, successfully diverting enormous tranches of capital directly into attacker-controlled wallets without triggering standard perimeter alarms.
The growing frequency and staggering scale of these state-sponsored incursions continue to prompt urgent warnings from regulatory bodies, intelligence agencies, and private sector security leaders. As cross-border investigations into the monumental Binance breach persist, the crypto industry faces mounting pressure to enhance internal security controls, fortify employee awareness against targeted social engineering campaigns, and deploy advanced real-time monitoring tools to disrupt the sophisticated laundering networks utilized by groups like TraderTraitor.
Comments (0)