Skip to main content
Uruguay Can

News from across crypto

TRM Links North Korea’s TraderTraitor to $6.3B Binance Hack

TRM Labs attributes the $6.36 billion Binance theft to North Korea’s TraderTraitor; Binance says about $3 billion is frozen and it will cover all losses.

Uruguay Can Editorial

TRM Links North Korea’s TraderTraitor to $6.3B Binance Hack

Binance had not publicly identified a culprit for its October 29 security incident when blockchain intelligence firm TRM Labs attributed the theft to TraderTraitor, a North Korean hacking group, on Friday. TRM says about $6.36 billion left Binance wallets across 10 blockchains, making it the largest crypto theft on record by its estimate.

TRM’s attribution is its assessment, not a confirmed finding from Binance or law enforcement. The firm says it based the conclusion on on-chain and off-chain intelligence, and noted similarities to earlier North Korea-linked attacks, including the 2025 Bybit hack. Chainalysis also assessed that TraderTraitor was likely responsible, according to the Associated Press.

How did the attacker move the funds?

TRM says the transfers began on October 29, with most of the $6.36 billion moved in about 20 minutes from 20:05 UTC. Its account of the suspected method breaks down into two parts:

  1. On Ethereum, the attacker used an EIP-7702 delegation and 50 pre-signed authorizations to make a Binance hot wallet act as a sweeper under the attacker’s control.
  2. On the other nine blockchains, Binance wallets sent funds to attacker-controlled addresses through ordinary signed transfers.

TRM says this points to a compromise of Binance’s hot-wallet signing infrastructure. Binance’s investigation has not yet established the full cause.

What has Binance confirmed, and what happens next?

Binance estimates the impact at about $6.3 billion and says roughly $3 billion has been frozen on-chain with its partners. In its security incident update, the exchange said its initial investigation suggested a compromised DevOps engineer’s laptop may have let an attacker access a service container and submit unauthorized withdrawals. Binance said it found no evidence of a wallet private-key leak.

The exchange says deposits remain operational, withdrawals are suspended while security checks are completed, and it will cover all losses using its SAFU fund and company funds. Binance has engaged law enforcement and blockchain intelligence partners to trace and recover assets, but its investigation into the breach and the attacker’s identity is ongoing.

Sources