THORChain

ZachXBT

Bitcoin

when

Multiple blockchain and cybersecurity investigators say the suspected <a rel="noopener noreferrer nofollow" href="https://www.binance.com/register?ref=TT5IWFGB">Binance</a> hack that reportedly involved losses of around $6.3 billion is linked to North Korea’s TraderTraitor group. The attribution—made by TRM Labs, Chainalysis, and independent onchain researcher ZachXBT—builds on earlier suspicions of North Korean tradecraft and ties the incident to previous major thefts attributed to the same actor.
While exact loss figures vary slightly across analysts, the key new development is the convergence of independent evidence: TRM Labs cites onchain and offchain intelligence, ZachXBT points to wallet-level fund flows across two separate incidents, and Chainalysis’ leadership characterizes the <a rel="noopener noreferrer nofollow" href="https://www.binance.com/register?ref=TT5IWFGB">Binance</a> theft as consistent with a broader pattern tied to TraderTraitor.
<h2 id="key-takeaways">Key takeaways</h2>
<ul>
 <li>TRM Labs attributed the Binance hack to North Korea’s TraderTraitor with “high confidence,” citing onchain and offchain intelligence.</li>
 <li>ZachXBT said funds from the Binance hack and the earlier <a rel="noopener noreferrer nofollow" href="https://partner.bitget.com/bg/cryptobreaking">Bitget</a> exploit were commingled at the same address after routing through THORChain, suggesting a shared operator.</li>
 <li>Chainalysis placed the Binance impact at about $6.4 billion and assessed it was likely executed by TraderTraitor due to links to earlier hacks.</li>
 <li>US authorities have previously linked TraderTraitor to large-scale crypto thefts, describing a social-engineering approach against employees.</li>
</ul>
<h2 id="attribution-tightens-around-tradertraitor">Attribution tightens around TraderTraitor</h2>
TRM Labs, a cybersecurity and crypto risk research firm, released an analysis stating that the Binance hack was carried out by TraderTraitor. In its attribution, TRM Labs relied on a blend of onchain behavior and offchain intelligence, describing the conclusion as high-confidence.
That assessment aligns with other investigators’ conclusions. ZachXBT—known for tracing illicit fund movements across chains and services—said that stolen funds from Binance were later commingled with proceeds from an earlier <a rel="noopener noreferrer nofollow" href="https://partner.bitget.com/bg/cryptobreaking">Bitget</a> exploit. According to ZachXBT, both sets of funds were routed through THORChain and then consolidated at the same address, a pattern he said strongly indicates the same actor is responsible for both incidents.
Chainalysis leadership similarly pointed back to TraderTraitor. Jonathan Levin, Chainalysis’ co-founder and CEO, characterized the Binance hack impact as approximately $6.4 billion, slightly higher than TRM Labs’ estimate of about $6.3 billion. He then linked the larger theft to the same North Korean group, arguing that the overlap with prior hacks makes TraderTraitor the most likely perpetrator.
<h2 id="how-fund-flows-connect-binance-and-bitget">How fund flows connect Binance and Bitget</h2>
The most actionable technical element in these attributions is the reported linkage between multiple thefts through shared laundering behavior.
ZachXBT said that after the Binance hack, the stolen funds did not remain isolated. Instead, they were later combined with funds tied to the Bitget exploit. He added that the commingling occurred after moving through THORChain and that the consolidation at the same address suggests coordinated activity rather than coincidental similarities.
For investigators and market participants, this matters because attribution based solely on “style” can be ambiguous. Fund-flow evidence—especially when it links incidents at the level of specific addresses and transaction routing—tends to be more durable. It also helps compliance teams build more precise risk rules, particularly when monitoring wallets, counterparties, or on/off-ramp behaviors that repeatedly appear across related campaigns.
<h2 id="earlier-suspicions-and-what-they-add">Earlier suspicions and what they add</h2>
The TraderTraitor attribution comes after prior commentary from other security analysts. Earlier coverage from <a rel="noopener noreferrer nofollow" href="https://sovrn.co/1h8llaz">Cointelegraph</a> noted that the Binance attack’s apparent sophistication and the way attackers prepared on-chain activity resembled tactics associated with North Korean groups.
That earlier perspective is important context: it frames the current attributions as the next step after pattern recognition. In other words, the new reports don’t just claim “it looks like North Korea”—they attempt to substantiate that view by connecting the Binance theft to a specific known cluster of actors and behaviors.
Still, some details remain subject to refinement. Different reports cite slightly different impact numbers, and attribution language varies by organization—from “high confidence” (TRM Labs) to broader assessments that emphasize links to previous hacks (Chainalysis). For readers, the consistent thread is the growing consensus around the same group, not the exact dollar total.
<h2 id="why-regulators-and-investigators-keep-returning-to-tradertraitor">Why regulators and investigators keep returning to TraderTraitor</h2>
US authorities have previously connected TraderTraitor to high-value crypto thefts. The FBI has said the group targets company employees through social engineering, which can create an initial access pathway that attackers then exploit to move funds.
In a notable case involving DMM <a rel="noopener noreferrer nofollow" href="https://coinstats.app/coins/bitcoin/">Bitcoin</a>, US and Japanese investigators attributed the theft of more than $300 million to North Korean actors. In that incident, investigators said an attacker posed as a recruiter and sent a malicious coding test to an employee of Ginco, a wallet provider. The resulting access was reportedly used to manipulate a legitimate transaction request, diverting funds to attacker-controlled wallets.
These descriptions support a broader pattern: rather than relying only on technical exploitation of protocols or systems, TraderTraitor-linked campaigns often combine human-targeting entry points with subsequent operational control over fund movement. That combination is particularly relevant for exchange and custody operators, because it shifts the focus from purely technical defenses to also include identity verification, employee security training, and strict controls over external communications and assignment workflows.
<h2 id="what-to-watch-next">What to watch next</h2>
With multiple independent investigators converging on TraderTraitor, the next phase will likely focus on operational follow-through: whether analytics firms and law enforcement can trace additional laundering links, identify more endpoints tied to the stolen funds, and translate these attributions into tighter monitoring and incident response practices across exchanges, custodians, and wallet providers.
This article was originally published as <a href="https://www.cryptobreaking.com/north-koreas-tradertraitor-tied-to/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">North Korea’s TraderTraitor Tied to $6.3B Binance Hack</a> on <a href="https://www.cryptobreaking.com/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">Crypto Breaking News</a> – your trusted source for crypto news, Bitcoin news, and blockchain updates.

North Korea’s TraderTraitor Tied to $6.3B Binance Hack

Table of Contents

Crypto Breaking News

Other articles published on Oct 30, 2026

Join our free newsletter for daily crypto updates!