North Korea's TraderTraitor Group Linked to $6.3 Billion Binance Hack
Key Takeaways
- •TRM Labs attributed the $6.3 billion Binance hack to the North Korea-linked TraderTraitor group with high confidence, and the loss would be the largest single theft in crypto history if the estimate holds.
- •Onchain investigator ZachXBT found that funds stolen from Binance and from the earlier Bitget exploit were commingled at the same address after moving through THORChain, indicating the same actor is likely behind both incidents.
- •Chainalysis CEO Jonathan Levin assessed that the $6.4 billion Binance hack was likely carried out by the DPRK group TraderTraitor based on links to previous hacks.
- •US authorities, including the FBI, have previously linked TraderTraitor to major crypto thefts such as the February 2025 Bybit hack and the more than $300 million DMM Bitcoin theft in May 2024, often employing social engineering against company employees.
- •The commingling of Binance and Bitget stolen funds at a single address gives analysts a shared onchain trail to follow as they track how the proceeds are moved.
Blockchain security researchers and onchain investigators have linked the $6.3 billion hack of crypto exchange Binance to TraderTraitor, a cybercrime group associated with North Korea. If the loss estimate holds, it would stand as the largest single theft in crypto's history, dwarfing prior incidents attributed to the group, including the more than $300 million DMM Bitcoin hack.
TRM Labs attributed the attack to TraderTraitor with “high confidence,” citing both onchain and offchain intelligence, according to its analysis.
Onchain investigator ZachXBT said funds stolen from Binance and from the earlier Bitget exploit were commingled at the same address after moving through THORChain, a cross-chain protocol that lets users swap assets between blockchains. “This indicates the same actor is likely behind both incidents,” he said, adding that the Bitget attack had already been attributed to TraderTraitor.
Jonathan Levin, co-founder and CEO of Chainalysis, also pointed to the North Korean group, saying it stole $6.4 billion — slightly above Binance's estimated $6.3 billion impact. “We assess Binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack,” he said.
The attribution follows an earlier assessment by Ido Ben-Natan, CEO of security firm Blockaid, who told Cointelegraph that the attack's sophistication and onchain preparations resembled North Korean activity.
US authorities have previously linked TraderTraitor — the name US agencies use for a cluster of North Korean activity focused on stealing cryptocurrency — to some of crypto's largest thefts, including the Bybit hack in February 2025. The FBI also joined US and Japanese investigators in attributing the theft of more than $300 million from DMM Bitcoin in May 2024 to North Korean actors.
According to the FBI, TraderTraitor targets company employees through social engineering. In the DMM case, an attacker posing as a recruiter sent a malicious coding test to an employee of wallet provider Ginco. Investigators said the resulting access was likely used to manipulate a legitimate transaction request, diverting funds to attacker-controlled wallets.
How the stolen funds are moved next — and whether agencies repeat the kind of public response seen after Bybit, when the FBI urged crypto companies to block the laundering of stolen proceeds — is among the open questions following the attribution. The commingling of Binance and Bitget funds at a single address gives analysts a shared onchain trail to follow.
Related: Bitget CEO suspects North Korea behind $352M hack, citing IP clues
