TRM links Binance’s $6.36B theft to North Korea’s TraderTraitor

Blockchain intelligence firm TRM Labs has attributed the theft of about $6.36 billion from Binance wallets to North Korea’s TraderTraitor hacking unit, a finding that would make it the largest crypto theft on record. The exchange says it will cover all losses and that about $3 billion has been frozen. The attribution remains an intelligence assessment: Binance says it is working with law enforcement to confirm who was responsible.

In its analysis of the Binance theft, TRM says the attacker moved funds from wallets on ten blockchains on Oct. 29, with most leaving in about 20 minutes. It valued the transfers at the price of each asset when taken. Binance’s Oct. 30 security update puts the estimated impact at around $6.3 billion and says withdrawals were temporarily suspended while security checks were underway. Deposits remain unaffected, according to Binance.

How does this compare with the Bybit theft?

At TRM’s estimate, the Binance incident is about four times the $1.5 billion Bybit hack of February 2025, which the FBI attributed to TraderTraitor. TRM says it found features shared with earlier North Korea-linked thefts, including preparation before the funds moved and signatures executed in a burst. Those similarities support its assessment, but do not by themselves establish the attackers’ identity.

The size also makes the response consequential. Binance says blockchain partners have frozen about $3 billion in affected assets and that the company and its Secure Asset Fund for Users will cover all losses. A freeze can limit what an attacker can move when an issuer or network authority can block assets; it does not mean the funds have been returned to users. Binance says it will publish an updated proof of reserves after remediation.

What does the wallet evidence show?

TRM’s account points to a compromise involving Binance’s hot-wallet signing process. On Ethereum, it says the attacker used an EIP-7702 authorization to make a Binance hot wallet execute a sweeper contract controlled by the attacker. TRM says the attacker prepared 50 signed authorizations in advance and used one to drain the wallet. On the other nine chains, it says Binance wallets sent funds in ordinary signed transfers. Taken together, those transactions led TRM to assess that the compromise reached signing infrastructure across multiple chains.

Binance’s initial investigation offers a different level of detail: the company says a compromised DevOps engineer’s laptop may have allowed an attacker into a service container to submit unauthorized withdrawals. It says it has found no evidence of a wallet private-key leak, and that it will release a technical post-mortem once the investigation is complete and facts are verified. That explanation is preliminary; the post-mortem may clarify how the access and signing activity fit together.

What should readers watch next?

The key signals are whether Binance restores withdrawals after security checks, how much of the frozen assets can be recovered, and whether its post-mortem confirms the access path described in its initial update. TRM’s attribution should also be weighed against any further findings from Binance and law enforcement. Until those arrive, the scale of the transfers is clear, while the identity claim remains the conclusion of blockchain intelligence firms rather than a confirmed finding by the exchange or authorities.

Sources and documents

• analysis of the Binance theft — trmlabs.com
• Oct. 30 security update — binance.com