Binance TraderTraitor attribution ties $6.4B hack to North Korea
TRM Labs and Chainalysis both blamed North Korea's TraderTraitor unit for the record Binance theft, while the exchange set aside $6.34 billion and aimed to reopen withdrawals by Sunday.
Two of the biggest names in blockchain forensics now point the same way. The Binance TraderTraitor attribution from TRM Labs and Chainalysis names a North Korean state-linked hacking group as the force behind the largest crypto theft ever recorded, and it reshapes how quickly anyone should expect the stolen coins to come back.
What happened
TRM Labs said it reached its conclusion with high confidence and sized the theft at roughly $6.36 billion, drained across 10 blockchains, most of it within about 20 minutes starting at 4:05 p.m. ET on Thursday. Chainalysis put the total near $6.4 billion and said its strongest clue came when it watched Binance funds mixing in real time with proceeds from last month's Bitget exploit, which had already been pinned on North Korean actors.
Both firms said the attacker's operating wallet was seeded through the Tornado Cash mixer. On Ethereum, TRM said, the intruder used an EIP-7702 delegation with 50 pre-signed authorizations to turn a Binance hot wallet into a sweeper, while the other nine chains saw ordinary signed transfers. That pattern suggests the hot-wallet signing setup itself was compromised, not just one laptop.
Binance chief executive Richard Teng said on Friday the company has reserved more than $6.34 billion of its own money, $5 billion of it already held in the exact tokens taken, and is buying the rest on the market and over the counter. Reuters reported, via Decrypt, that the FBI and the U.S. Secret Service are involved in the probe.
Why it matters
The FBI pinned the $1.5 billion Bybit theft of February 2025 on this same TraderTraitor unit, so investigators know its playbook: fast conversion out of freezable stablecoins, heavy automation and, eventually, cash-out through professional laundering networks. Chainalysis chief Jonathan Levin told CNBC his team is seeing laundering patterns it has not met before, with funds cycled repeatedly among addresses.
That matters for recovery math. TRM counts about $2.67 billion of stablecoins frozen by Tether, Circle, Ripple and World Liberty Financial, yet the attacker still controls more than 420,000 ETH and 18,270 BTC, roughly $2.4 billion that no issuer can block. Our earlier coverage of the Binance security incident and the Circle and Tether freeze tracked the first containment wave; the attribution now explains why the second wave is so much harder.
What's next
The near-term checkpoints are the Sunday withdrawal target and a full proof-of-reserves report Binance promised by Monday. Decrypt's write-up of the TRM and Chainalysis findings carries the technical detail.
If withdrawals restart on schedule and reserves reconcile, the Binance TraderTraitor attribution becomes a law-enforcement story more than a solvency story. A slip on either date would revive the stress trade quickly.
The call
We say Binance stays solvent. Polymarket's "Major CEX insolvent in 2026?" market priced No at 96% at 08:23 MSK on Oct. 31; the contract covers Binance, Coinbase, Bybit, OKX and Kraken through December 31. Liquidity is modest, so treat it as a sentiment gauge. With $6.34 billion ring-fenced and about $3 billion frozen, the Binance TraderTraitor attribution reads as a recovery fight, not a balance-sheet hole.
This article is for information only and is not investment advice. Calls are editorial forecasts, logged with market odds at the time of publication and kept on the record.