TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor

What it is

TRM Labs (with "high confidence") and Chainalysis attribute the Binance theft to TraderTraitor, the North Korean group the FBI blamed for the February 2025 Bybit hack ($1.5 billion). TRM puts the loss at about $6.36 billion across 10 chains, Chainalysis at about $6.4 billion. Most of it moved in roughly 20 minutes starting 4:05 p.m. ET on Thursday. Pangolin Intelligence also told CNN it believes a North Korean unit is responsible. North Korea has previously denied hacking allegations.

How it works

On Ethereum, per TRM, the attacker used an EIP-7702 delegation (from the Pectra upgrade, which lets an ordinary wallet run contract code) to turn a Binance hot wallet into a sweeper. Fifty authorizations were pre-signed in advance. On the other nine chains, Binance wallets sent funds through ordinary signed transfers. TRM reads that as compromise of Binance's hot wallet signing infrastructure.

Binance says the investigation began with a compromised engineer's laptop and has found "additional points of breach." Decrypt notes that Bybit also began with one compromised machine, a Safe developer's computer.

flowchart LR
    A[Compromised engineer laptop] --> B[Hot wallet signing infrastructure]
    B --> C[Ethereum: EIP-7702 sweeper, 50 pre-signed authorizations]
    B --> D[9 other chains: ordinary signed transfers]
    C --> E[Laundering and freeze race]
    D --> E

Attribution evidence

• Chainalysis saw stolen funds commingle in real time with proceeds of last month's Bitget exploit, which had been attributed to North Korean actors. It calls this the strongest evidence.
• The attacker's operational wallet was funded through Tornado Cash (TRM and Chainalysis).
• TRM cites staging that began well before the theft, matching Bybit and April's KelpDAO exploit.

Laundering and recovery

Chainalysis reports "never-seen-before laundering patterns": thousands of transactions in a short time, suggesting automation that cycles funds among addresses. TRM says the attacker sold USDT to market makers and borrowed ETH against USDT on Aave to get ahead of issuer freezes.

The attacker now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion that no issuer can freeze. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins. Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB. Binance puts total frozen funds at about $3 billion.

Binance has reserved more than $6.34 billion of its own funds to cover losses, $5 billion of it already held in the stolen tokens. It is buying the rest on the market and over the counter. These figures exclude frozen assets.

Caveats

The article gives no indicators of compromise, wallet addresses or detection guidance. The signing-infrastructure compromise is TRM's assessment, and Binance's investigation is still open. Attribution rests on the firms' on-chain and off-chain analysis, which the article does not detail beyond the points above.