TRM links $6.36B Binance theft to North Korea

On Oct. 29, crypto intelligence firm TRM Labs said North Korea’s TraderTraitor group was likely behind the theft of about $6.36 billion from Binance wallets across 10 blockchains, the largest crypto theft on record, according to TRM’s account of its investigation.

• About $6.36 billion was moved, mostly within 20 minutes.
• Roughly $2.7 billion in assets was frozen, TRM said.
• The attacker retained about $2.4 billion in assets beyond issuers’ reach.

TRM called its North Korea attribution a high-confidence assessment based on on-chain and off-chain intelligence. Binance has not confirmed who was responsible. The exchange said it was investigating a security incident and would cover losses.

What points to TraderTraitor?

TRM said the attack showed features it had seen in earlier North Korea-linked thefts, including the $1.5 billion Bybit hack in February 2025. It identified small withdrawals from Tornado Cash, a service that obscures the source of crypto, and signs that the attacker prepared and tested code before the theft.

The firm traced transfers from Binance wallets to attacker-controlled addresses on 10 blockchains. Its account says the transfers began on Oct. 29, with most of the funds moved in about 20 minutes starting at 20:05 UTC. Bitcoin, Ethereum, Tron, Solana and the XRP Ledger were among the networks involved.

Chainalysis also assessed that TraderTraitor was likely behind the Binance hack, according to the Associated Press report. Binance told AP it was working with law enforcement to confirm the criminals’ identity.

How did the attacker move the funds?

TRM’s analysis says the attacker used a pre-signed authorization to make a Binance Ethereum hot wallet run code controlled by the attacker. A hot wallet is connected to the internet and used to process customer withdrawals. The code swept funds into an attacker-controlled address, then repeated the transfers as more crypto arrived.

On other networks, TRM said Binance wallets sent funds through standard signed transfers. The firm said the pattern across different chains points to access to Binance’s hot-wallet signing infrastructure, but Binance had not published a root cause as of TRM’s report.

TRM counted about $3.79 billion in outflows from Ethereum wallets, including 200,630 ETH and tokens such as USDT and USDC. It also traced 18,270 BTC, worth about $1.47 billion at the time, from Binance Bitcoin wallets.

How much was frozen, and what remains?

TRM said Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, while Arbitrum’s Security Council moved assets worth about $30 million out of the attacker’s reach. Binance separately said it had worked with blockchain partners to freeze roughly $3 billion.

The attacker converted some stablecoins into crypto that issuers could not freeze, including ETH and BTC, TRM said. It estimated about $2.4 billion remained beyond any issuer’s reach. Binance said deposits were unaffected, withdrawals were suspended during security checks, and users would be covered for losses, AP reported.

Sources and documents

• TRM’s account of its investigation — trmlabs.com
• Associated Press report — apnews.com