Chainalysis and TRM Tie $6.4B Binance Hack to North Korean Group TraderTraitor
Chainalysis and TRM Labs pin the Binance hack on TraderTraitor, the group the FBI blamed for Bybit. The attacker used EIP-7702 on Ethereum, swapped stablecoins into ETH within minutes and still holds over 420,000 ETH and 18,270 BTC.
Two of the largest blockchain forensics firms have pinned the Binance hack on TraderTraitor, the North Korean group the FBI blamed for the $1.5 billion Bybit theft. TRM Labs made the attribution "with high confidence." A Chainalysis spokesperson told CNN it had "high confidence" as well.
We covered Binance's confirmation of the hack, and our earlier coverage detailed the freezes and Binance's buyback of stolen altcoins. The new material is attribution, method and where the money sits now.
Chainalysis called the strongest evidence the real-time commingling of stolen funds with proceeds of last month's Bitget exploit, which had been attributed to North Korean actors. Pangolin Intelligence also told CNN it believed a North Korean unit was responsible. North Korea has previously denied hacking allegations.
TRM and Chainalysis both said the attacker's operational wallet was funded through Tornado Cash. TRM said that and the pre-theft staging matched the Bybit hack and April's KelpDAO exploit.
How the funds moved
On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper. Chainalysis said the signed authorizations let the hot wallet run attacker-deployed code. Fifty were prepared in advance. On the other nine chains, wallets sent funds through ordinary signed transfers. TRM says this points to compromise of Binance's hot wallet signing infrastructure.
Binance's own account differs in emphasis. It said its initial investigation points to a compromised engineer's laptop that gave access to a service container, with no evidence of a private key leak. It has since found "additional points of breach."
Funds left on 10 blockchains, most within about 20 minutes. Start times differ: TRM says 4:05 p.m. ET Thursday, while Chainalysis says around 4:20 p.m. ET on October 29, with freezes starting by 5:14 p.m. ET. Size estimates vary too. Binance: about $6.3B. TRM: about $6.36B. Chainalysis: about $6.4B.
Laundering and what the attacker holds
Chainalysis said the attacker swapped $325M in stablecoins into $285M of ETH in about 20 minutes and sent the remaining $175M to stopover wallets. TRM said the attacker sold USDT to market makers and borrowed ETH against USDT on Aave. Chainalysis reports "never-seen-before laundering patterns," with thousands of automated transactions.
The attacker now holds over 420,000 ETH and 18,270 BTC, roughly $2.4B beyond the reach of stablecoin issuers.
Tether, Circle, Ripple and World Liberty Financial froze about $2.67B in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6M ARB, per TRM.
Market impact
Bitcoin dropped toward $76,000 on Friday morning and traded near $76,700 at writing. Liquidations hit $1.5B, including $468M in BTC and $358M in ETH.
Standard Chartered's Geoffrey Kendrick said negative price action may have some way to go and that the incident could accelerate a shift toward decentralized exchanges.
Context
The pattern is familiar. Bybit's 2025 breach began with a compromised Safe developer machine; Binance's probe points to a compromised engineer laptop. If confirmed at this scale, the theft would be the largest crypto hack on record.
Binance says it reserved over $6.34B of company funds, excluding frozen assets, and plans an updated Proof of Reserves. Reuters, citing a source, reported Binance is working with the FBI and the U.S. Secret Service.
