Skip to main content
Uruguay Can

News from across crypto

TRM and Chainalysis link North Korea to $6.3B Binance hack

TRM Labs and Chainalysis say North Korea’s TraderTraitor likely stole $6.3 billion from Binance, while the exchange says roughly $3 billion has been frozen.

Uruguay Can Editorial

TRM and Chainalysis link North Korea to $6.3B Binance hack

Binance had not named a culprit; on Friday, blockchain intelligence firms linked its $6.3 billion hack to North Korea’s TraderTraitor group, a claim that would make the theft the largest crypto heist on record. The Associated Press report said TRM Labs made the attribution with “high confidence,” while Chainalysis also assessed that TraderTraitor was likely responsible.

TRM said the attacker moved about $6.36 billion from Binance wallets across ten blockchains, with most of the funds leaving in roughly 20 minutes. That estimate is close to Binance’s reported $6.3 billion impact. The attribution is an assessment by blockchain firms, however: Binance said it is working with law enforcement to identify the criminals.

What evidence points to TraderTraitor?

Chainalysis cited links to previous hacks attributed to the group. Elliptic said its analysis found that some funds stolen from Binance reached the same Ethereum address as proceeds from the suspected North Korea-linked Bitget exploit. The firm said the attack’s methods were consistent with TraderTraitor, which is associated with the Lazarus Group.

That on-chain overlap supports the firms’ assessment, but it does not amount to an official finding. Elliptic’s analysis said no government or law-enforcement agency had confirmed who was behind the Binance theft, and Binance had not commented on the attribution.

How did the funds leave Binance?

Binance’s initial investigation suggested a compromised DevOps engineer’s laptop may have let an attacker access a service container and submit unauthorized withdrawal transactions. The exchange said it had found no evidence that wallet private keys were leaked. That distinction matters: the reported route involved access to systems that could request withdrawals, rather than evidence that the keys themselves were exposed.

Binance said it had worked with blockchain partners to freeze roughly $3 billion in affected assets. It also said it would cover all losses. Its investigation is ongoing, and the exchange said it would share more technical details once the facts are verified.

Sources