North Korea's TraderTraitor Group Linked to $6.3 Billion Binance Hack

TRM Labs has assigned the Binance breach to TraderTraitor with a high degree of certainty, drawing evidence from both blockchain data and external intelligence sources.

Blockchain analyst ZachXBT revealed that assets stolen from both Binance and a prior Bitget hack were consolidated into a single address after passing through THORChain.

He noted, "This strongly suggests a common perpetrator for both breaches," recalling that TraderTraitor was earlier linked to the Bitget incident.

Jonathan Levin, Chainalysis’ co-founder and CEO, reinforced this view by estimating the group stole approximately $6.4 billion — a sum slightly exceeding Binance’s $6.3 billion loss.

He commented, "We believe the $6.4 billion Binance hack was likely orchestrated by the DPRK-based TraderTraitor group due to its connection with the earlier hacking event."

This conclusion follows a prior analysis by Blockaid CEO Ido Ben-Natan, who told Cointelegraph that the complexity and blockchain preparations align with tactics commonly attributed to North Korean threat actors.

US government agencies have tied TraderTraitor to several massive cryptocurrency thefts, such as the February 2025 hack of Bybit. Additionally, the FBI collaborated with US and Japanese law enforcement to trace over $300 million stolen from DMM Bitcoin in May 2024 back to North Korean hackers.

The FBI has reported that TraderTraitor employs social engineering to target company staff. In the DMM Bitcoin case, the attackers impersonated recruiters by sending a malicious programming test to an employee at wallet provider Ginco. Investigators believe this breach was exploited to alter legitimate transaction requests, redirecting cryptocurrency to wallets controlled by the hackers.

The findings reveal a sophisticated and persistent threat from North Korea’s TraderTraitor group, posing substantial risks to major cryptocurrency platforms worldwide.