North Korean Group’s Trail of Billions
The recent $6.3 billion hack on Binance has been traced to North Korea’s notorious TraderTraitor group, according to multiple blockchain intelligence firms. TRM Labs and Chainalysis, both leading cybersecurity outfits, have publicly attributed the attack to TraderTraitor with what they describe as “high confidence,” referencing a blend of onchain data and offchain intelligence. The scale of the theft is staggering: TRM Labs estimates the loss at $6.36 billion, while Chainalysis pegs it slightly higher at $6.4 billion, all siphoned out of Binance wallets across ten different blockchains in less than half an hour on October 29.
This figure eclipses even the Bybit hack from February 2025, which itself was attributed to North Korean actors and resulted in a $1.5 billion loss—less than a quarter of the Binance total.
The FBI and Japanese authorities attributed the $300 million DMM Bitcoin theft in May 2024 to the same North Korean group.
Binance Funds Mixed With Bitget Loot
Onchain investigator ZachXBT identified that funds stolen from Binance were commingled with assets from the previous Bitget exploit, both routed through THORChain before landing at the same address. This finding is significant: the Bitget incident had already been linked to TraderTraitor by blockchain analysts, reinforcing suspicions that a single North Korean operation is behind both attacks.
Funds from two major hacks converging at one wallet raises questions about operational overlaps and laundering techniques within DPRK-linked cybercrime groups.
Despite these links, Binance maintains there was no evidence of a wallet private key leak; instead, the breach reportedly stemmed from a compromised engineer’s laptop that allowed unauthorized access to a service container and enabled mass withdrawals.
See Also
Sophisticated Onchain Prep Flags DPRK
The technical sophistication behind the Binance hack has drawn direct comparisons to past North Korean operations. According to cointelegraph.com, Blockaid CEO Ido Ben-Natan noted that both the complexity of the attack and its onchain preparations closely matched patterns seen in previous DPRK-linked exploits. For example, on Ethereum, the attacker leveraged an EIP-7702 delegation—an advanced feature—to convert a Binance hot wallet into a sweeper controlled by the hacker, using 50 pre-signed transactions ready in advance. This level of planning is rare outside state-backed cybercrime.
Both TRM Labs and Chainalysis observed that the attacker’s operational wallet was funded via Tornado Cash, an anonymizing protocol frequently used by North Korean hacking groups to obscure transaction trails.
Frozen Funds Slow Down the Hackers
While more than $6 billion was siphoned out swiftly, global responses have managed to freeze a substantial portion of those assets. Tether alone locked over $1.56 billion in USDT, Circle froze upwards of $800 million in USDC, and First Digital halted movement on FDUSD associated with the attack. In total, Binance reports that approximately $3 billion has been frozen across various tokens and blockchains since the incident began.
Other players also intervened: Arbitrum’s Security Council froze 8,426 ETH and nearly 75 million ARB tokens; Ripple and World Liberty Financial added their own freezes on stablecoins connected to the hack. Yet even with these rapid actions—most freezes began within 70 minutes after withdrawals started—the hackers managed to move billions before authorities could intervene fully.
Binance has reserved more than $6.34 billion in company funds to cover user losses, with $5 billion already held in tokens matching those stolen during the breach.
Why it matters
The speed and scale of this attack underscore ongoing vulnerabilities within even the largest crypto platforms. The fact that TraderTraitor has now been linked not only to this record-setting theft but also to earlier exploits—including Bybit’s $1.5 billion loss in 2025 and DMM Bitcoin’s $300 million heist in May 2024—shows how persistent and adaptable North Korea’s cyber units have become.
A tension emerges here: while billions have been frozen thanks to coordinated action by exchanges and stablecoin issuers, just as much remains unrecovered or already laundered through complex cross-chain movements—highlighting both progress and limits in crypto forensics.
Key risks to monitor
If the remaining unfrozen portion of the $6.3 billion stolen from Binance on October 29 is moved or laundered by TraderTraitor-linked wallets—especially after $3 billion has already been frozen by Tether, Circle, and others—immediate large-scale asset flows could occur across multiple blockchains.