Cybersecurity researchers and an onchain investigator have linked the $6.3 billion Binance hack to TraderTraitor, a North Korean group previously associated with major cryptocurrency thefts.
Attribution points to a repeat actor
TRM Labs said it had high confidence that TraderTraitor was responsible for the Binance attack, based on a combination of onchain and offchain intelligence. Chainalysis co-founder and CEO Jonathan Levin also identified the group as the likely perpetrator, putting the value of the stolen assets at $6.4 billion, slightly above Binance’s estimated $6.3 billion impact.
The attribution was also supported by onchain investigator ZachXBT. He said funds taken in the Binance incident and an earlier Bitget exploit eventually converged at the same address after being moved through THORChain, a cross-chain protocol. Because the Bitget attack had already been attributed to TraderTraitor, ZachXBT said the shared movement of funds indicated that the same actor was likely behind both incidents.
The findings were reported by Cointelegraph. They follow an earlier assessment from Blockaid CEO Ido Ben-Natan, who said the attack’s sophistication and preparations visible onchain resembled activity associated with North Korean operators.
TraderTraitor’s reported methods
US authorities have connected TraderTraitor to several large cryptocurrency thefts. Those cases include the Bybit hack in February 2025 and the theft of more than $300 million from Japan-based DMM Bitcoin in May 2024, which the FBI attributed to North Korean actors alongside US and Japanese investigators.
According to the FBI’s account of the DMM Bitcoin incident, TraderTraitor targets employees using social engineering. In that case, an attacker posing as a recruiter sent a malicious coding test to an employee at wallet provider Ginco. Investigators said the access obtained through that operation was likely used to manipulate a legitimate transaction request and redirect funds to wallets controlled by the attacker.
This background is relevant to the Binance attribution because it shows the type of employee-focused compromise that authorities have previously associated with the group. However, the conclusions about the Binance incident are based on the intelligence and blockchain links described by the researchers.
Moneyiar market picture
Moneyiar data at 2026-10-25 22:39 +03:30 showed BNB trading at $740.8618136891, up 0.81% over 24 hours and 3.32% over seven days. Other tracked assets were mixed:
- Chainlink (LINK): $11.4919002167, down 0.49% in 24 hours and 3.57% over seven days.
- FUNToken (FUN): $0.0089182414, up 1.62% in 24 hours and 0.08% over seven days.
- Alchemy Pay (ACH): $0.0050519273, down 2.05% in 24 hours and 2.83% over seven days.
The figures provide a market snapshot alongside the continuing investigation into the Binance breach. The researchers’ attribution remains focused on identifying the actor and tracing the movement of the stolen cryptocurrency.
