Blockchain analytics firms TRM Labs and Chainalysis have attributed the recent $6.4 billion hack of Binance to TraderTraitor, a North Korean state-sponsored hacking group previously linked to the FBI for the $1.5 billion Bybit exploit in February 2025. The theft, described by both firms as the largest crypto heist on record, occurred on Thursday when approximately $6.36 billion was moved out of Binance wallets across 10 blockchains within roughly 20 minutes starting at 4:05 p.m. ET. TRM Labs stated its attribution was made with "high confidence" based on robust on- and off-chain intelligence, noting that the attacker's operational wallet was funded through Tornado Cash, a pattern consistent with earlier North Korea-linked attacks including the KelpDAO exploit.
Chainalysis corroborated the attribution after observing stolen Binance funds commingling in real time with proceeds from last month's Bitget exploit, which had also been attributed to North Korean actors. The attack methodology involved using an EIP-7702 delegation feature introduced in Ethereum's Pectra upgrade to turn a Binance hot wallet into a controlled sweeper, alongside ordinary signed transfers on other chains, suggesting a compromise of Binance's signing infrastructure. While Binance initially cited a compromised engineer's laptop, it later acknowledged additional points of breach. The attacker has since employed automated laundering techniques, selling USDT to market makers and borrowing ETH against USDT on Aave to evade freezes, currently holding over 420,000 ETH and 18,270 BTC worth about $2.4 billion beyond issuer reach.
In response, Binance announced it has reserved more than $6.34 billion of company funds to cover user losses, with $5 billion already held in the affected tokens. Stablecoin issuers Tether, Circle, Ripple, and World Liberty Financial have frozen approximately $2.67 billion, while Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB. Binance stated it is working with law enforcement and industry partners to trace and recover additional funds, asserting it will "weather this storm." This incident underscores persistent threats from North Korean hackers, who recently faced U.S. Treasury sanctions for IT worker schemes moving millions in crypto.
The attribution of the Binance breach to TraderTraitor reinforces the strategic targeting of major centralized exchanges by North Korean state-sponsored actors, leveraging sophisticated technical exploits like EIP-7702 delegations to bypass traditional security perimeters. Unlike previous incidents where single-point failures were cited, the involvement of multiple blockchain networks and advanced laundering automation indicates a highly organized operation capable of executing large-scale thefts with minimal latency. The rapid movement of funds and use of mixers such as Tornado Cash highlight the limitations of current on-chain tracing capabilities in preventing immediate asset dissipation, even when attribution is high-confidence.
From an institutional risk perspective, Binance’s commitment to cover losses with reserved capital demonstrates a defensive posture aimed at maintaining user trust and regulatory standing amidst significant operational failure. However, the scale of the theft—four times larger than the Bybit incident—signals escalating stakes for exchange security protocols. The ability of attackers to hold billions in assets beyond issuer freeze capabilities suggests that recovery efforts may face diminishing returns, potentially shifting the burden entirely onto exchange balance sheets. This event serves as a critical stress test for the resilience of centralized custodians against nation-state level cyber warfare tactics.
