TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor

In brief

• TRM Labs and Chainalysis have both attributed the Binance hack to TraderTraitor, the North Korean group the FBI blamed for the $1.5 billion Bybit hack.
• Chainalysis said it saw Binance funds commingling with proceeds of last month's Bitget exploit, which had been attributed to North Korean actors.
• Binance said it has reserved more than $6.34 billion of company funds to cover losses, $5 billion of it already held in the affected tokens.

Three blockchain analytics firms have attributed this week's hack of Binance to North Korea, with two of the largest naming TraderTraitor, a North Korean hacking group, as responsible for what both describe as the largest crypto theft on record.

TRM Labs said it made the attribution "with high confidence," based on "robust on and off-chain intelligence." It put the theft at about $6.36 billion, moved out of Binance wallets on 10 blockchains, most of it in about 20 minutes from 4:05 p.m. ET on Thursday. That is about four times the $1.5 billion Bybit hack of February 2025, which the FBI attributed to the same group, TRM noted.

Chainalysis, which put the total at about $6.4 billion, said the strongest evidence came when its investigators saw funds stolen from Binance commingling in real time with funds from last month's Bitget exploit, which had been attributed to North Korean actors.