Blockchain analysts point to North Korea's TraderTraitor in Binance theft

The theft of $6.3 billion from Binance is increasingly being linked to North Korea. Two of the best-known blockchain analytics firms say the attack bears the marks of a state-backed hacking unit with a long record of targeting crypto companies.

What happened

Chainalysis and TRM Labs have both tied the hack to TraderTraitor, a North Korean group they also blame for the earlier attack on the exchange Bybit. TRM Labs said it has high confidence in the attribution. Other security researchers have pointed more broadly to the Lazarus Group, the umbrella name often used for North Korea’s hacking operations.

On-chain investigator ZachXBT said he found stolen funds from the Binance hack and from an earlier hack of the exchange Bitget converging at the same address. US agencies, including the FBI and the Secret Service, are investigating the theft and helping trace the stolen assets.

Background

North Korea has been blamed for many of the largest crypto thefts of recent years. Researchers say the proceeds help fund the country’s weapons programmes while it remains cut off from much of the global financial system.

Attribution in crypto usually rests on patterns: how attackers gain access, which tools they use, and where the stolen funds go next. When money from separate hacks lands in the same wallet, analysts treat it as strong evidence of a shared operator.

Why it matters

If the attribution holds, recovering the funds will be harder. State-backed groups are patient, skilled at laundering, and beyond the reach of ordinary law enforcement.

It also raises the stakes for exchanges, bridges and other services the stolen coins may pass through. They will be under pressure to spot and block the funds before they can be converted into cash.