Binance Hack: TRM and Chainalysis Tie $6.3B Theft to North…

Blockchain analytics firms TRM Labs and Chainalysis have tied the $6.3 billion Binance hack to North Korea, naming TraderTraitor, a state-backed hacking unit linked to the Lazarus Group, as the likely attacker. Binance itself has not named a culprit, and no government agency has yet made a formal attribution. TRM Labs said in a report published early on 30 October that it attributes the theft to TraderTraitor "with high confidence", based on on-chain and off-chain intelligence. Chainalysis also assessed that the hack was likely the work of the same North Korean group, according to CoinDesk. Blockchain investigator ZachXBT described the attacker as "likely Lazarus". At about $6.3 billion, the Binance hack is the largest crypto theft on record, roughly four times the $1.5 billion that the FBI says TraderTraitor stole from Bybit in February 2025.

Key Takeaways

• TRM Labs attributes the Binance hack to North Korea's TraderTraitor "with high confidence". Chainalysis and ZachXBT point the same way.
• Binance has not named an attacker. It says a compromised DevOps engineer's laptop gave the attacker access to systems that submit withdrawals.
• Two days before the hack, Binance said it had blocked North Korea-linked attacks that used fake job interviews to get people to run malicious code.
• TRM counts about $6.36 billion stolen across ten blockchains, about $2.7 billion frozen and roughly $2.4 billion in ETH and BTC still under the attacker's control.
• No government agency has attributed the attack yet. In the Bybit case, the FBI named TraderTraitor five days after the theft.

Who Is TraderTraitor?

TraderTraitor is the name the FBI uses for a North Korean state-sponsored hacking operation, also tracked by security firms as Jade Sleet and Slow Pisces. It is widely treated as part of the broader Lazarus Group. The FBI attributed the $1.5 billion Bybit theft to TraderTraitor in February 2025, and US and Japanese authorities had earlier linked the group to the $308 million theft from Japanese exchange DMM Bitcoin in May 2024. The group usually gets in through people rather than through code. Its operators pose as recruiters or business contacts and persuade employees at crypto firms to run malicious software, which then gives them a foothold inside company systems. North Korea-linked hackers have been behind a string of large thefts this year. In September, FinanceFeeds reported that Bitget said its $351.6 million hack was "very likely" linked to North Korea. Our explainer on how North Korean hackers target digital assets covers the wider pattern.

Why Investigators Point to North Korea

TRM said several features of the Binance attack match earlier North Korea-linked heists, including Bybit and the $292 million KelpDAO bridge attack in April 2026:

• Mixer funding. Small Tornado Cash withdrawals funded the operator wallet from 28 October, at least 36 hours before the theft.
• Staging and rehearsal. The attacker deployed its code early on 29 October, tested it on two wallets and rehearsed the final version on a third.
• Signatures in advance. TRM said signatures were obtained in advance and then executed in one burst. On Ethereum, a single transaction carried 50 authorizations signed by a Binance hot wallet.

FinanceFeeds' on-chain review on the night of the hack found the same pattern on Ethereum. The Tornado-funded address deployed its contract more than four hours before the drain, switched the Binance 14 hot wallet to that contract through an EIP-7702 delegation, and first ran identical delegate-and-sweep transactions against three smaller wallets. TRM added that transfers on the other chains were ordinary signed transactions, which in its view "points to a compromise of Binance's hot wallet signing infrastructure."

The Laptop and the Fake Job Interviews

Binance's own account of the breach fits that picture. In a statement at 02:25 UTC on 30 October, the exchange said its initial investigation suggests the incident may involve a compromised DevOps engineer's laptop, which let the attacker reach a service container and submit unauthorized withdrawals. Binance said it found no evidence that private keys had leaked. Two days earlier, on 27 October, Binance said it had fended off several North Korea-linked cyberattacks over the previous week, with no systems compromised and no assets lost, Crypto Briefing reported. Binance tied those attempts to "Contagious Interview", a campaign in which attackers pose as employers and persuade job candidates to run malicious code during fake hiring tests. Binance has not said how the engineer's laptop was compromised, and there is no public evidence yet that it is linked to that campaign. But a developer's machine is exactly the kind of target such campaigns are built to reach. The Bybit theft also began on a developer's machine, at wallet provider Safe.

Investor Takeaway

Attribution does not change who pays, because Binance has pledged to cover all losses. It does shape the recovery odds: North Korean groups tend to move stolen funds quickly through swaps, bridges and OTC brokers, and funds that escape the first freezes are rarely recovered.

Where the Stolen Funds Are Now

According to TRM's figures as of 00:30 UTC on 30 October:

• Frozen: about $2.7 billion, mostly by Tether (about 1.77 billion USDT) and Circle (about 825 million USDC), with smaller amounts frozen by Ripple, World Liberty Financial and the Arbitrum Security Council. Binance puts the frozen total at about $3 billion.
• Converted: the attacker sold about 325 million USDT to market makers and solvers for roughly 122,300 ETH, about 10% below market, and borrowed about 19,760 ETH on Aave against 60 million USDT before Aave froze the affected markets.
• Bitcoin: 18,270 BTC are being split into 1,000 BTC and 100 BTC pieces.
• Out of reach: more than 420,000 ETH and 18,270 BTC, about $2.4 billion that no issuer can freeze.

TRM expects the next stage of laundering to run through cross-chain bridges, swap services and over-the-counter brokers.

What Happens Next

Binance has promised a detailed technical post-mortem and says it is working with law enforcement to identify the attackers. It expects to resume withdrawals within 48 hours and says it will cover all losses from its SAFU fund and company funds. The next signal on attribution is likely to come from governments. After the Bybit theft on 21 February 2025, the FBI publicly named TraderTraitor on 26 February. A similar statement on Binance would turn the analytics firms' assessment into an official finding. In the Bybit case, the FBI also published attacker addresses and asked exchanges to block them. FinanceFeeds will update this story as Binance, investigators and authorities respond.

Investor Takeaway

Watch for three things: an FBI or other government statement naming the attacker, Binance's post-mortem on how the laptop was compromised, and movement from the attacker's ETH and BTC wallets, which exchanges and market makers are now screening.