TRM, Chainalysis Attribute $6.4B Binance Hack to North Korea's TraderTraitor

Two blockchain analytics firms have attributed this week's hack of Binance to North Korea, naming the TraderTraitor group as responsible for what they describe as the largest crypto theft on record. TRM Labs said it made the attribution "with high confidence," putting the theft at about $6.36 billion moved from Binance wallets across 10 blockchains. Chainalysis estimated the total at about $6.4 billion, citing funds from the Binance theft commingling in real time with proceeds from last month's Bitget exploit, which had been tied to North Korean actors. Both firms said the attacker's wallet was funded through Tornado Cash, matching patterns seen in the February 2025 Bybit hack and April's KelpDAO exploit. On Ethereum, the attacker used an EIP-7702 delegation to convert a Binance hot wallet into a controlled sweeper with 50 pre-signed authorizations, pointing to a compromise of Binance's hot wallet signing infrastructure. Tether, Circle, Ripple and World Liberty Financial have frozen about $2.67 billion in stablecoins; Binance said it has reserved more than $6.34 billion of company funds to cover the incident.