TRM Labs and Chainalysis attributed this week's Binance hack to North Korea's TraderTraitor group, calling it the largest crypto theft on record at approximately $6.4 billion.
TRM said it made the attribution "with high confidence" based on "robust on and off-chain intelligence." The stolen funds moved across 10 blockchains, with most transferred in about 20 minutes starting at 4:05 p.m. ET on Thursday. TRM noted the theft is about four times larger than the $1.5 billion Bybit hack of February 2025, which the FBI attributed to the same group.
Chainalysis identified the strongest evidence when investigators saw Binance funds commingling in real time with funds from last month's Bitget exploit, which had been attributed to North Korean actors. A Chainalysis spokesperson told CNN the firm had "high confidence" North Korea was responsible. Singapore-based Pangolin Intelligence also told CNN it believed a North Korean hacking unit was responsible.
Both TRM and Chainalysis said the attacker's operational wallet was funded through Tornado Cash. TRM noted the staging, timing, and other features matched earlier North Korea-linked attacks including Bybit and April's KelpDAO exploit.
On Ethereum, the attacker used an EIP-7702 delegation from the Pectra upgrade to turn a Binance hot wallet into a sweeper with 50 pre-signed authorizations prepared in advance. Binance wallets on nine other chains sent funds through ordinary signed transfers, pointing to a compromise of Binance's hot wallet signing infrastructure according to TRM.
Binance said its investigation began with a compromised engineer's laptop but uncovered "additional points of breach." The company reserved more than $6.34 billion to cover losses, with $5 billion already held in stolen tokens.
Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins. Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB. Binance put total frozen assets at about $3 billion.
The attacker employed "never-seen-before laundering patterns" according to Chainalysis, using thousands of transactions in short periods suggesting automated circulation among addresses. The attacker sold USDT to market makers and borrowed ETH against USDT on Aave to race issuer freezes, and now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer's reach according to TRM.