North Korea Implicated in Record-Breaking Binance Hack
Three blockchain analytics firms have pointed to North Korea as the perpetrator behind this week’s massive hack of Binance, with two of the leading firms identifying the North Korean hacking group TraderTraitor as responsible for what they are calling the largest cryptocurrency theft on record.
TRM Labs stated it made the attribution “with high confidence,” citing “robust on and off-chain intelligence.” The firm estimated the stolen amount at approximately $6.36 billion, moved from Binance wallets across 10 blockchains, with the majority of the funds transferred in about 20 minutes starting at 4:05 p.m. ET on Thursday. TRM noted this figure is roughly four times the $1.5 billion stolen in the February 2025 Bybit hack, which the FBI also attributed to the same group.
Chainalysis, which placed the total theft at around $6.4 billion, found its strongest evidence when its investigators observed funds stolen from Binance being commingled in real-time with funds from the previous month’s Bitget exploit, an incident previously linked to North Korean actors.
A spokesperson for Chainalysis informed CNN that the firm has “high confidence” that North Korea was behind the hack. Pangolin Intelligence, a Singapore-based firm, also told CNN it believes a North Korean hacking unit was responsible, based on its analysis of on-chain activity and correlation with information from past incidents. North Korea has consistently denied allegations of hacking.
Both TRM and Chainalysis reported that the attacker’s operational wallet was initially funded through Tornado Cash, a cryptocurrency mixer. TRM highlighted that this, along with other indicators such as preparatory staging that began well before the theft, aligns with previous North Korea-linked attacks, including the Bybit hack and the April KelpDAO exploit.
On the Ethereum network, the attacker utilized an EIP-7702 delegation, a feature introduced in Ethereum’s Pectra upgrade that allows a standard wallet to execute smart contract code. According to TRM, this was used to transform a Binance hot wallet into a controlled “sweeper” wallet, with 50 pre-signed authorizations prepared in advance. Funds from Binance wallets on the other nine blockchains were transferred to the attacker through standard signed transactions. TRM’s assessment suggests this points to a compromise of Binance’s hot wallet signing infrastructure.
Binance has stated that its investigation began with a compromised engineer’s laptop but has since uncovered “additional points of breach.” The Bybit attack also originated from a single compromised machine; North Korean hackers reportedly planted malicious code in the infrastructure of wallet provider Safe after compromising a Safe developer’s computer, as reported by Decrypt at the time.
The attacker has moved swiftly to launder the stolen assets. Chainalysis reported observing “never-seen-before laundering patterns,” with thousands of transactions occurring in a short period, indicating the use of automation to repeatedly circulate funds among various addresses. TRM added that the attacker sold USDT to market makers and borrowed ETH against USDT on the lending protocol Aave to circumvent issuer freezes. The attacker now holds over 420,000 ETH and 18,270 BTC, valued at approximately $2.4 billion, beyond the reach of issuers.
Tether, Circle, Ripple, and World Liberty Financial have frozen about $2.67 billion in stablecoins. Arbitrum’s Security Council also froze 8,426 ETH and 74.6 million ARB, according to TRM. Binance estimates the total frozen amount to be around $3 billion.
Binance has initiated the process of recovering affected assets for its users and continues to collaborate with law enforcement, issuers, blockchain intelligence firms, and industry partners to trace, freeze, and recover additional funds.
In an update on Friday, Binance announced it has reserved over $6.34 billion of company funds to cover the incident, with $5 billion already held in the exact tokens that were stolen. The exchange is acquiring the remaining amount through market and over-the-counter channels, which “can take longer because some tokens may have low liquidity.” These figures do not include the assets that have been frozen.
“We will weather this storm,” Binance stated.
North Korean hackers have a history of targeting the exchange. In August 2025, Binance Chief Security Officer Jimmy Ng told Decrypt that North Korean attackers attempt to get hired at Binance daily and described them as the single biggest threat to cryptocurrency companies. On Wednesday, the U.S. Treasury sanctioned 10 individuals and one entity for North Korean IT worker schemes that facilitated the movement of millions of dollars in cryptocurrency.
Leave a Reply