TRM Labs Links $6.36 Billion Binance Hack to North Korean Group TraderTraitor

Blockchain intelligence firm TRM Labs has attributed the Binance attack to North Korea’s state-sponsored hacking group TraderTraitor, saying its assessment is based on on-chain and off-chain intelligence and carries “high confidence.”

According to TRM, approximately $6.36 billion moved out of Binance wallets across ten blockchains on October 29. Most of the transfers occurred within about 20 minutes, beginning at 20:05 UTC. The firm described it as the largest cryptocurrency theft on record.

Binance separately estimated the incident’s impact at approximately $6.3 billion and said around $3 billion in affected assets had been frozen through cooperation with blockchain partners.

The exchange said preliminary findings suggest a compromised DevOps engineer’s laptop may have allowed an attacker to access a service container and submit unauthorised withdrawal transactions. It reported no evidence of wallet private keys being leaked.

Binance temporarily suspended deposits and withdrawals during security checks and said it would cover all losses through its SAFU emergency fund and company funds.

The investigation remains ongoing.