TRM links North Korea’s TraderTraitor to Binance hack that moved about $6.36B

The Story

Blockchain intelligence firm TRM said it has high-confidence evidence that a North Korean hacking unit, TraderTraitor, was behind the Binance hack in which an attacker moved about USD 6.36 billion out of Binance wallets on ten blockchains in roughly 20 minutes.

Binance said it worked with blockchain partners to freeze roughly $3 billion in affected assets. The exchange said deposits were unaffected, while withdrawals were suspended and expected to resume in the next day or two, and it said it would cover all losses.

In an X post on Friday, Binance said an initial investigation suggested the incident may have involved a compromised laptop, but that a subsequent investigation identified additional “points of breach.” Binance also said on X it found no evidence of any wallet private key leak and that it would release more technical details once its probe is complete.

TRM said the attacker moved most of the funds in about 20 minutes, and it described the theft as the largest cryptocurrency theft on record. TRM attributed the attack to TraderTraitor in a post on its website Thursday, and it said several features matched earlier North Korea-linked heists, including the Bybit hack.

Chainalysis also believed the Binance hack was “likely done by DPRK group TraderTraitor,” according to a post by co-founder and CEO Jonathan Levin on X. The FBI previously said North Korea and TraderTraitor were responsible for the hack.

Binance said it is “working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice.” Asked about potential ties to North Korea, a Binance spokesperson said only that the company is working with law enforcement partners.

The hack is also raising questions about controls, cybersecurity firm NyxLab cofounder and CEO Kok Tin Gan said. He said the incident “looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet,” referring to wallets connected to the internet that hold users’ private keys.

The event comes after other major crypto thefts. In February last year, another exchange, Bybit, suffered a $1.5 billion hit when it was hacked.

Changpeng Zhao, known as CZ, founded Binance in 2017 and later pleaded guilty to a felony related to failing to prevent money laundering on the platform and stepped down as CEO. In 2025, U.S. President Donald Trump pardoned Zhao. Zhao posted on X on Thursday that “User funds are safe!” and said the theft “does look like a hack on Binance,” adding that while he does not manage Binance anymore, “as a shareholder, I expect all user funds will be fully covered.”