Cybersecurity researchers from TRM Labs and Chainalysis, along with onchain investigator ZachXBT, have linked the $6.3 billion Binance hack to North Korea’s TraderTraitor group.
TRM Labs attributed the attack to TraderTraitor with “high confidence,” citing onchain and offchain intelligence.
ZachXBT said funds stolen from Binance and the earlier Bitget exploit were commingled at the same address after moving through THORChain.
“This indicates the same actor is likely behind both incidents,” he said, adding that the Bitget attack had been attributed to TraderTraitor.
Chainalysis co-founder and CEO Jonathan Levin also pointed to TraderTraitor, saying the group stole $6.4 billion, slightly above Binance’s estimated $6.3 billion impact.
“We assess Binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack,” he said.
The attribution follows an earlier assessment by Blockaid CEO Ido Ben-Natan, who told Cointelegraph that the attack’s sophistication and onchain preparations resembled North Korean activity.
US authorities have linked TraderTraitor to some of crypto’s largest thefts, including the Bybit hack in February 2025. The FBI also joined US and Japanese investigators in attributing the theft of more than $300 million from DMM Bitcoin in May 2024 to the North Korean actors.
The FBI says TraderTraitor targets company employees through social engineering. In the DMM case, an attacker posing as a recruiter sent a malicious coding test to an employee of wallet provider Ginco. Investigators said the resulting access was likely used to manipulate a legitimate transaction request, diverting funds to attacker-controlled wallets.
Related: Bitget CEO suspects North Korea behind $352M hack, citing IP clues
