Cybersecurity researchers from TRM Labs and Chainalysis, alongside onchain investigator ZachXBT, have attributed the $6.3 billion Binance hack to North Korea’s TraderTraitor group. TRM Labs stated it holds "high confidence" in this assessment, citing both onchain and offchain intelligence. The attribution aligns with earlier observations by Blockaid CEO Ido Ben-Natan, who noted that the attack's sophistication and preparation methods resembled known North Korean operational patterns.
ZachXBT provided critical forensic evidence linking the incidents, revealing that funds stolen from Binance were commingled at a single address with assets from an earlier Bitget exploit after moving through THORChain. This overlap suggests the same actor is likely responsible for both breaches, particularly since the Bitget attack had already been attributed to TraderTraitor. Chainalysis co-founder Jonathan Levin corroborated the link, assessing that the group stole approximately $6.4 billion, a figure slightly higher than Binance’s estimated $6.3 billion impact.
This development extends a pattern of US authorities linking TraderTraitor to major cryptocurrency thefts, including the February 2025 Bybit hack and the May 2024 theft of over $300 million from DMM Bitcoin. In the DMM case, investigators determined that attackers used social engineering, posing as recruiters to send malicious coding tests to employees of wallet provider Ginco. This access was then exploited to manipulate legitimate transaction requests, diverting funds to attacker-controlled wallets.
The convergence of independent forensic analyses from TRM Labs, Chainalysis, and ZachXBT significantly strengthens the case against TraderTraitor, moving beyond speculative attribution to evidence-based linkage via shared infrastructure and fund commingling. The specific detail regarding THORChain routing and subsequent address overlap provides a tangible trail that connects disparate exploits, suggesting a coordinated campaign rather than isolated incidents. This multi-source validation reduces the likelihood of false positives and highlights the persistent threat vector posed by state-sponsored actors targeting centralized exchange liquidity.
From an Operational Risk perspective, the recurrence of social engineering tactics—such as the recruiter impersonation seen in the DMM Bitcoin breach—indicates that TraderTraitor continues to prioritize human-centric vulnerabilities over purely technical exploits. Exchanges must reassess their internal security protocols, particularly regarding employee vetting and external communication channels, as sophisticated phishing remains a primary entry point. The scale of the losses underscores the inadequacy of current defensive measures against well-resourced adversaries who can blend technical precision with psychological manipulation.
