North Korea’s TraderTraitor linked to $6.3B Binance hack
TRM Labs says it has high confidence in the attribution, while ZachXBT identified stolen funds from the Binance and Bitget hacks converging at the same address.
Onchain investigators from TRM Labs, Chainalysis, and ZachXBT have linked the $6.3 billion Binance hack to North Korea's TraderTraitor group. TraderTraitor has previously been attributed to two other major crypto thefts, including the Binance hack and the Bitget exploit. ZachXBT observed that stolen funds from both Binance and Bitget converged at the same address after moving through THORChain, indicating the involvement of the same actor in both incidents.
Chainalysis co-founder and CEO Jonathan Levin also pointed to TraderTraitor, estimating the group stole $6.4 billion, slightly above the $6.3 billion impact on Binance. The attribution comes after US authorities linked TraderTraitor to other significant crypto heists, such as the Bybit hack in February 2025 and the DMM Bitcoin breach in May 2024.
The FBI says the North Korean actors target company employees using social engineering tactics, as seen in the DMM case where an attacker posed as a recruiter to gain access to wallet provider Ginco's systems.
Written by urgent.news from Cointelegraph's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
- Binance hack may involve private key ‘misuse,’ not theft: Blockaid CEO cointelegraph.com
