Researchers claim that North Korea's “TraderTraitor” is related to a $6.3 billion Binance hacking incident
TRM Labs indicates that they have 'high confidence' in this attribution; on-chain investigator ZachXBT points out that the funds stolen in the hacker attacks by Binance and Bitget were pooled into the same address after going through THORChain.
Cybersecurity research institutions TRM Labs and Chainalysis, as well as online investigator ZachXBT, have linked this $6.3 billion Binance hacking incident to the North Korean hacking group TraderTraitor.
TRM Labs indicates that, based on both on-chain and off-chain intelligence, it is 'highly confident' in attributing this attack to TraderTraitor.
On-chain investigator ZachXBT indicated that the funds stolen from the vulnerabilities exploited in Binance and even earlier in Bitget were transferred through THORChain and then mixed into the same address.
He said, "This indicates that there is a high likelihood that the same perpetrator is behind both incidents." He also added that the Bitget attack had previously been attributed to TraderTraitor.
Chainalysis, co-founder and CEO, also pointed the finger at TraderTraitor, claiming that the organization stole $6.4 billion, which is slightly higher than the $6.3 billion impact estimated by Binance.
He said, "Our assessment is that the $6.4 billion Binance hacking incident is very likely to have been carried out by a TraderTraitor organization from the Democratic People's Republic of Korea, as there are links between it and previous hacking incidents."
This attribution conclusion follows closely on the earlier assessments by Blockaid CEO Ido Ben - Natan. Ben-Natan previously informed Cointelegraph that the complexity of this attack and the preparatory work on the blockchain are similar to those associated with North Korean activities.
U.S. authorities have linked TraderTraitor to some of the largest theft cases in the cryptocurrency industry, including the Bybit hacking incident in February 2025. The Federal Bureau of Investigation (FBI), together with investigators from the United States and Japan, has attributed over $300 million stolen from DMM Bitcoin in May 2024 to North Korean actors.
The Federal Bureau of Investigation (FBI) stated that TraderTraitor uses social engineering techniques to target company employees. In the DMM case, an attacker disguised as a recruiter sent a malicious programming test to an employee of wallet provider Ginco. Investigators believe that the access obtained in this way was likely used to manipulate a legitimate transaction request and transfer funds to a wallet under the attacker's control.
Related Reading:The CEO suspects that North Korea is involved in the $352 million hacking incident, stating that there are IP clues pointing to that country.
