TRM Labs Ties $6.36B Binance Hack to North Korea's TraderTraitor

Blockchain analytics firm TRM Labs said it believes with "high confidence" that TraderTraitor, a North Korean state-backed hacking unit, carried out Thursday's theft of about $6.36 billion from Binance.

That puts a name on the largest crypto theft on record. In a blog post, TRM said the money left Binance wallets on 10 blockchains, most of it in about 20 minutes starting at 4:05 p.m. ET. The FBI named the same group for the $1.5 billion Bybit theft in February 2025.

Chainalysis CEO Jonathan Levin also said the attack was likely TraderTraitor's work, CNBC reported. Neither is a government finding.

Signatures prepared in advance

TRM said preparation began at least 36 hours earlier, funded through Tornado Cash, a service that hides where crypto came from.

How the Ethereum leg worked: EIP-7702, added in Ethereum's May 2025 upgrade, lets an ordinary wallet hand its behavior to a smart contract by signing an authorization. Each wallet keeps a running transaction count, and an authorization only works at the right count. TRM said the attacker had 50 signed authorizations ready for 50 counts in a row, so one would fit no matter how many withdrawals Binance processed. One matched, and a sweeper contract emptied the wallet.

Wallets on nine other chains paid the attacker through ordinary signed transfers. In TRM's view, that points to a compromise of Binance's hot-wallet signing system, which approves payouts. Binance said late Thursday that an engineer's compromised laptop may be the cause, and it has not published a full root cause.

What's frozen and what isn't

TRM counted about $2.7 billion frozen by Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council. The attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion that no issuer can freeze, the firm said.

Bitcoin was at $77,578 at 6 a.m. ET, down 3.2% in 24 hours, and BNB at $702, down 6.2%, per CoinGecko. Black Mint found no public response from North Korea.

In our opinion: If the attribution holds, this is TraderTraitor's second record theft in under two years, about four times Bybit's size. The $2.4 billion in bitcoin and ether is the part that matters now, because only tracing and cooperating exchanges can stop it. Watch for the coins to hit bridges and over-the-counter desks, and for Binance's post-mortem to say whether one laptop really reached the signing system.