TRM links $6.36B Binance hack to North Korea’s TraderTraitor

TRM Labs attributed the Oct. 29 theft of about $6.36 billion from Binance wallets to North Korea’s TraderTraitor hacking unit, while Binance said it had frozen roughly $3 billion in affected assets, according to the Associated Press report. TRM said the funds were moved across ten blockchains, most within about 20 minutes, and described its attribution as high confidence.

Chainalysis also assessed that TraderTraitor was likely responsible, its co-founder and CEO Jonathan Levin wrote on X, AP reported. Binance said it was working with law enforcement to identify the attackers and would cover users’ losses.

What evidence links the theft to North Korea?

TRM said the incident shared features with earlier North Korea-linked thefts, including the 2025 Bybit hack, AP reported. Elliptic separately said it found Binance theft proceeds at an address that had received funds from the suspected North Korea-linked Bitget exploit, according to Elliptic’s analysis.

Elliptic said the address overlap was small and did not prove the same hackers carried out both thefts. It said no government or law enforcement agency had confirmed responsibility as of its Oct. 30 report.

How did the attacker move the funds?

Elliptic’s analysis found that the attacker drained Binance hot wallets across multiple blockchains. On Ethereum, the attacker used a smart-contract delegation feature to direct a Binance wallet to a “sweeper” contract, which then transferred assets, Elliptic said.

Binance initially said a compromised employee laptop may have played a role, then reported finding additional points of breach, AP reported. The exchange said deposits were unaffected, withdrawals were suspended, and it would cover all losses.

How much of the stolen crypto was frozen?

Binance said blockchain partners helped freeze roughly $3 billion, and that the exchange was beginning to recover assets for users, AP reported. Elliptic independently verified $2.84 billion in frozen funds, mostly stablecoins, in its Oct. 30 analysis.

Elliptic said the attacker had converted some stablecoins into assets that issuers cannot freeze, including ether and bitcoin. It estimated that about $3.28 billion in such assets remained under the attacker’s control at the time of its report.

Sources

• Associated Press report — apnews.com
• Elliptic’s analysis — elliptic.co