- Published on
North Korea linked to $6.3B Binance hack by crypto investigators
- Authors
- Name
- DeepHorus
Cybersecurity researchers have linked the $6.3 billion Binance hack to North Korea’s TraderTraitor group. TRM Labs attributed the attack with “high confidence,” citing onchain and offchain intelligence. Chainalysis and onchain investigator ZachXBT also pointed to the same North Korean actor. The attribution makes the Binance breach one of the largest crypto thefts tied to Pyongyang.
The findings connect the Binance incident to an earlier Bitget exploit. ZachXBT said stolen funds from both hacks were commingled at the same address after moving through THORChain. He said this indicated the same actor was likely behind both incidents. The Bitget attack had already been attributed to TraderTraitor.
Chainalysis co-founder and CEO Jonathan Levin also blamed TraderTraitor. He said the group stole $6.4 billion, slightly above Binance’s estimated $6.3 billion impact. Levin cited links to previous hacks as the basis for the assessment. Blockaid CEO Ido Ben-Natan had earlier said the attack’s sophistication and onchain preparations resembled North Korean activity.
US authorities have tied TraderTraitor to some of crypto’s largest thefts. The group was linked to the February 2025 Bybit hack. The FBI also joined US and Japanese investigators in attributing the May 2024 theft of more than $300 million from DMM Bitcoin to North Korean actors.
The FBI says TraderTraitor targets company employees through social engineering. In the DMM case, an attacker posing as a recruiter sent a malicious coding test to a Ginco employee. Investigators said the resulting access was likely used to manipulate a legitimate transaction request, diverting funds to attacker-controlled wallets.
The latest attribution could intensify scrutiny of North Korea’s crypto operations and exchange security. It may also support law enforcement and sanctions efforts. Investigators are continuing to trace the commingled funds through cross-chain services.
