Three blockchain intelligence firms have linked this week’s theft from Binance to North Korea, with TRM Labs and Chainalysis identifying the suspected attacker as TraderTraitor, the group the FBI blamed for the $1.5 billion Bybit hack in February 2025.
TRM and Chainalysis described the incident as the largest cryptocurrency theft recorded. TRM estimated that approximately $6.36 billion was taken, while Chainalysis put the figure at about $6.4 billion. The assets were transferred from Binance wallets across 10 blockchains, with most of the movement occurring within roughly 20 minutes from 4:05 p.m. Eastern Time on Thursday.
According to Decrypt, TRM made its attribution with “high confidence,” citing on-chain and off-chain intelligence. Chainalysis said its strongest evidence came from observing Binance-related funds commingle in real time with proceeds from last month’s Bitget exploit, which had also been attributed to North Korean actors. Singapore-based Pangolin Intelligence separately told CNN that it believed a North Korean hacking unit was responsible after reviewing transaction activity and comparing it with known previous incidents. North Korea has denied hacking allegations.
Evidence pointing to TraderTraitor
Both TRM and Chainalysis said the attacker’s operational wallet had been funded through Tornado Cash, a cryptocurrency mixer designed to make transaction trails more difficult to follow. TRM also said the attack showed other similarities to earlier North Korea-linked operations, including the Bybit theft and April’s KelpDAO exploit. These included preparations that began well before the funds were removed.
The scale of the Binance incident is substantially larger than the Bybit hack. TRM said the estimated loss was about four times the $1.5 billion stolen from Bybit, an attack the FBI attributed to TraderTraitor. The identification matters because blockchain analytics firms and law-enforcement agencies use transaction patterns, wallet links and operational behavior to connect new attacks with previously observed groups.
The firms’ findings do not mean that every stolen asset has been permanently lost. Stablecoin issuers and blockchain authorities have frozen part of the funds, while Binance says it is pursuing further recoveries.
How the wallet compromise unfolded
TRM said the attacker used a feature on Ethereum known as EIP-7702. Introduced through Ethereum’s Pectra upgrade, the feature allows a standard wallet to execute smart-contract code. In this case, the attacker used it to turn a Binance hot wallet into a wallet-controlled “sweeper,” with 50 pre-signed authorizations prepared in advance.
On the other nine affected blockchains, Binance wallets transferred assets through ordinary signed transactions. TRM said this pattern pointed to a compromise of Binance’s hot-wallet signing infrastructure, which is used to authorize transactions from wallets connected to the exchange’s operating systems.
Binance initially said its investigation began after an engineer’s laptop was compromised. The exchange later said it had found “additional points of breach.” The development echoes the Bybit attack, where North Korean hackers reportedly inserted malicious code into the infrastructure of wallet provider Safe after compromising a Safe developer’s computer.
The stolen assets have also been moved rapidly. Chainalysis reported what it called “never-seen-before laundering patterns,” including thousands of transactions in a short period. The activity suggested that automated systems were repeatedly circulating funds between addresses. TRM said the attacker sold USDT to market makers and borrowed ETH against USDT on Aave, a crypto lending protocol, in an effort to move assets before issuers could freeze them.
TRM said the attacker now holds more than 420,000 ETH and 18,270 BTC, together worth about $2.4 billion and beyond the reach of any single asset issuer’s freeze mechanism.
Binance’s response and market picture
Tether, Circle, Ripple and World Liberty Financial have frozen approximately $2.67 billion in stablecoins, according to TRM. Arbitrum’s Security Council separately froze 8,426 ETH and 74.6 million ARB. Binance has put the total value of frozen assets at about $3 billion.
In a Friday update, Binance said it had reserved more than $6.34 billion in company funds to cover the incident. Of that amount, $5 billion was already held in the same tokens that were stolen. The exchange said it was acquiring the remainder through market and over-the-counter transactions, a process that can take longer when individual tokens have limited liquidity. The reserve figures do not include frozen assets. Binance also said it had begun recovering affected assets for users and was cooperating with law-enforcement agencies, issuers, blockchain intelligence companies and other industry participants.
Moneyiar market data recorded BNB at $740.8618136891 as of October 25, 2026, at 22:39 +03:30. BNB was up 0.81% over 24 hours and 3.32% over seven days at that time. The supplied Moneyiar data is dated before the reported hack and therefore does not provide a post-incident market reading.
North Korean groups have repeatedly targeted cryptocurrency businesses. Binance Chief Security Officer Jimmy Su said in August 2025 that North Korean attackers attempted to obtain jobs at Binance daily and described them as the largest threat to crypto companies. On Wednesday, the U.S. Treasury sanctioned 10 people and one entity over North Korean information-technology worker schemes that moved millions of dollars in cryptocurrency.
