North Korea’s TraderTraitor Linked to $6.3B Binance Hack
Security researchers attribute the massive Binance exploit to the notorious TraderTraitor hacking group.
1Massive Binance Security Breach
A significant security incident involving a $6.3 billion theft from Binance has been formally linked to the North Korean hacking group known as TraderTraitor. Cybersecurity researchers from TRM Labs and Chainalysis provided this attribution, citing high confidence based on detailed onchain and offchain intelligence gathered following the massive financial exploit.
2Onchain Evidence and Convergence
Onchain investigator ZachXBT identified that funds stolen from the Binance hack and the earlier Bitget exploit converged at the same digital address. These assets were moved through the THORChain protocol before reaching the destination. This technical overlap strongly suggests that the same malicious actor is responsible for both major incidents.
3Chainalysis Assessment of Losses
Jonathan Levin, CEO of Chainalysis, estimated the total impact of the Binance hack at approximately $6.4 billion. This figure slightly exceeds the initial $6.3 billion estimate provided by other sources. Levin confirmed that the assessment is based on clear links to previous hacks previously attributed to the TraderTraitor group.
4Sophistication of Attack Methods
Blockaid CEO Ido Ben-Natan noted that the attack displayed a high level of sophistication consistent with North Korean state-sponsored activity. The preparations observed onchain mirrored previous patterns associated with the group. This assessment aligns with the broader consensus among cybersecurity experts regarding the operational capabilities of the TraderTraitor entity.
5Historical Pattern of Thefts
US authorities have previously linked TraderTraitor to several of the largest cryptocurrency thefts in history. Notable incidents include the Bybit hack in February 2025 and the $300 million DMM Bitcoin theft in May 2024. The FBI collaborated with Japanese investigators to confirm the North Korean involvement in the DMM case.
6Social Engineering Tactics Employed
The FBI reports that TraderTraitor frequently targets company employees through advanced social engineering techniques. In the DMM Bitcoin incident, attackers posed as recruiters to send a malicious coding test to a Ginco employee. This method granted the attackers access, allowing them to manipulate legitimate transaction requests and divert funds.
7Operational Security and Attribution
The attribution process relies on tracking the movement of stolen assets across decentralized protocols like THORChain. By analyzing the flow of funds, investigators can connect disparate hacks to a single source. This methodology remains critical for identifying state-sponsored actors who utilize complex obfuscation techniques to hide their illicit financial activities.
8Implications for Crypto Security
The scale of the $6.3 billion Binance hack underscores the persistent threat posed by state-sponsored actors to global financial infrastructure. As these groups refine their social engineering and technical exploitation methods, exchanges must enhance their internal security protocols. Protecting employee access points is now as vital as securing the blockchain itself.
Original article: Cointelegraph.com News — North Korea’s TraderTraitor Linked to $6.3B Binance Hack