Investigators link $6.3B Binance hack to North Korea's TraderTraitor group
In brief
- TRM Labs attributed the Binance hack to TraderTraitor with "high confidence," citing onchain and offchain intelligence.
- Chainalysis CEO Jonathan Levin put the theft at $6.4 billion, above Binance's $6.3 billion estimate.
- ZachXBT said Binance and Bitget funds were commingled at one address after moving through THORChain.
- Government and law-enforcement bodies have not attributed the Binance hack, according to Cointelegraph's report.
What the investigators found
TRM Labs attributed the attack to TraderTraitor with "high confidence," citing onchain and offchain intelligence. Chainalysis co-founder and CEO Jonathan Levin also pointed to TraderTraitor, and he put the group's haul at $6.4 billion, slightly above Binance's own $6.3 billion estimate of the impact.
“We assess Binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack,” he said.
The two loss figures don't match.
Blockaid CEO Ido Ben-Natan had made an earlier call, telling Cointelegraph that the attack's sophistication and onchain preparations resembled North Korean activity.
The Bitget connection
ZachXBT said funds stolen from Binance and from the earlier Bitget exploit were commingled at the same address after moving through THORChain. He added that the Bitget attack had already been attributed to TraderTraitor. In his reading, that points to the same actor likely being behind both incidents (he didn't go further than "likely").
Bitget's CEO had separately said he suspected North Korea was behind a $352 million hack, citing IP clues, according to a related Cointelegraph headline.
TraderTraitor's track record
Cointelegraph's report doesn't cite any government or law-enforcement attribution for the Binance hack. US authorities have linked TraderTraitor to some of crypto's largest past thefts, including the Bybit hack in February 2025. The FBI also joined US and Japanese investigators in attributing the theft of more than $300 million from DMM Bitcoin in May 2024 to the North Korean actors.
The FBI says the group targets company employees through social engineering. In the DMM case, an attacker posing as a recruiter sent a malicious coding test to an employee of wallet provider Ginco, and investigators said the resulting access was likely used to manipulate a legitimate transaction request, diverting funds to attacker-controlled wallets.
Cointelegraph's report doesn't say how the attackers got into Binance.
Frequently asked questions
Who is TraderTraitor?
TraderTraitor is a North Korean group that US authorities have linked to some of crypto's largest thefts, including the Bybit hack in February 2025. The FBI says it targets company employees through social engineering.
Why do investigators connect the Binance hack to the Bitget exploit?
ZachXBT said funds stolen from Binance and from the earlier Bitget exploit were commingled at the same address after moving through THORChain. He noted the Bitget attack had been attributed to TraderTraitor, which he said points to the same actor likely being behind both.
How much was stolen in the Binance hack?
Binance estimated the impact at $6.3 billion. Chainalysis CEO Jonathan Levin put the figure TraderTraitor stole at $6.4 billion, slightly higher than Binance's estimate, according to Cointelegraph.
