Analytics Firms Link Binance’s $6.4 Billion Hack to North Korean Group

Table of Contents

• You might want to know
• Main Topic
• Key Insights Table
• Afterwards...

You might want to know

• What evidence led investigators to connect the Binance theft to North Korea’s TraderTraitor group?
• How much of the stolen cryptocurrency has been frozen, and what has Binance said it will do to cover user losses?

Main Topic

Three blockchain analytics firms have linked the theft from Binance to North Korean actors. Two of them, TRM Labs and Chainalysis, specifically identified TraderTraitor, a North Korean hacking group that the FBI previously blamed for the $1.5 billion Bybit hack in February 2025. The firms described the Binance incident as the largest cryptocurrency theft on record. Their conclusions draw on blockchain transaction analysis and intelligence about previous attacks, although North Korea has previously denied hacking allegations.

TRM Labs said it made its attribution “with high confidence,” citing “robust on and off-chain intelligence.” The firm estimated that approximately $6.36 billion was taken from Binance wallets across 10 blockchains. Most of the funds were moved in about 20 minutes, beginning at 4:05 p.m. ET on Thursday. TRM compared the estimated theft with the $1.5 billion Bybit attack, noting that the Binance incident was about four times larger.

Chainalysis placed the total value at approximately $6.4 billion. It said a key piece of evidence emerged when investigators observed Binance-related funds commingling in real time with proceeds from last month’s Bitget exploit, which had been attributed to North Korean actors. A Chainalysis spokesperson told CNN that the firm had “high confidence” North Korea was behind the Binance hack.

Singapore-based Pangolin Intelligence also told CNN that it believed a North Korean hacking unit was responsible. The firm said its assessment was based on “analyzing the on-chain activity related to this hack and correlating with information gathered from previous known incidents.” These conclusions are analytical attributions rather than public confirmation by the alleged perpetrators, and North Korea has previously rejected claims that it conducts cyberattacks.

TRM Labs and Chainalysis both reported that the attacker’s operational wallet had been funded through Tornado Cash, a cryptocurrency mixer. TRM also pointed to other characteristics that it said resembled earlier North Korea-linked incidents. These included preparatory activity that began well before the theft, as well as similarities to the Bybit hack and April’s KelpDAO exploit. Investigators use such overlaps to build an attribution, but blockchain activity and operational patterns must be considered alongside other intelligence.

How the attack worked

TRM’s account of the attack describes different transfer methods across the affected networks. On Ethereum, the attacker used an EIP-7702 delegation, a feature introduced in Ethereum’s Pectra upgrade. It allows an ordinary wallet to run smart-contract code. The attacker used the feature to turn a Binance hot wallet into a sweeper under the attacker’s control, with 50 pre-signed authorizations prepared in advance, according to TRM.

On the other nine chains, Binance wallets sent funds to the attacker through ordinary signed transfers. TRM said that this pattern points to a compromise of Binance’s hot-wallet signing infrastructure. The findings describe the technical path investigators observed; Binance has separately shared information about its own investigation and the potential entry points involved.

Binance said its investigation began with a compromised engineer’s laptop, but later uncovered “additional points of breach.” The incident has a notable comparison with the Bybit attack, which also began with a compromised machine. Decrypt reported at the time that North Korean hackers planted malicious code in the infrastructure of wallet provider Safe after compromising a Safe developer’s computer. Similarities between incidents can help investigators identify potential connections, but they do not by themselves establish that the same tools or individuals were used.

Tracing and freezing the stolen funds

Investigators said the attacker moved quickly to launder funds that could not be retained directly. Chainalysis reported “never-seen-before laundering patterns,” including thousands of transactions within a short period. The firm said the activity suggested that automation was being used to circulate funds repeatedly among addresses, making the movement of assets more complex to follow.

TRM said the attacker also sold USDT to market makers and borrowed ETH against USDT on the lending protocol Aave, in an apparent effort to move assets before issuers could freeze them. According to TRM, the attacker now holds more than 420,000 ETH and 18,270 BTC. The firm valued those holdings at about $2.4 billion beyond any issuer’s reach. These figures represent assets that TRM said remained outside the reach of issuers at the time of its assessment.

Some assets have nevertheless been frozen. TRM reported that Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins. Arbitrum’s Security Council also froze 8,426 ETH and 74.6 million ARB. Binance put the total amount frozen at about $3 billion. The reported amounts reflect figures from different parties and categories of assets, so they should be understood as the estimates each source provided.

Binance said it had begun recovering affected assets for users and was continuing to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds. The company also said that its public commitment to cover losses was supported by a substantial reserve of company funds.

In an update on Friday, Binance said it had reserved more than $6.34 billion of company funds to cover the incident. It said $5 billion of that amount was already held in the exact tokens that had been stolen. Binance was buying the remainder through market and over-the-counter channels, which it said “can take longer because some tokens may have low liquidity.” Binance added that these reserve figures did not include frozen assets. The exchange said, “We will weather this storm.”

The episode also comes amid a longer record of North Korean efforts to target the cryptocurrency industry. In August 2025, Binance chief security officer Jimmy Su told Decrypt that North Korean attackers tried to get hired at Binance every day and described them as the single biggest threat to crypto companies. On Wednesday, the U.S. Treasury sanctioned 10 individuals and one entity over North Korean IT worker schemes that moved millions of dollars in cryptocurrency. Those separate developments offer context for the industry’s concern about both direct attacks and attempts to gain access through employment or contractor channels.

Overall, the incident combines a large-scale theft, rapid movement of assets and a coordinated response involving the exchange, analytics firms, issuers, a blockchain security council and law enforcement. The precise attribution comes from firms interpreting transaction patterns and other intelligence. The recovery effort, meanwhile, depends on whether remaining assets can be identified and whether organizations with the ability to intervene can act before funds move beyond their reach.

Key Insights Table

Afterwards...

The next stage will depend on continued tracing, cooperation among exchanges and asset issuers, and the ability to freeze or recover funds before they move beyond intervention. Binance has said it is working with law enforcement, analytics firms, issuers and industry partners, while maintaining that it has reserved company funds to cover the incident. Investigators’ attribution and recovery estimates may evolve as more information becomes available. For the broader cryptocurrency industry, the case underscores the importance of protecting wallet-signing systems, monitoring unusual transaction patterns and limiting the risk posed by compromised devices and access credentials.