TraderTraitor cyber group from North Korea connected to massive $6.3B Binance breach
Attribution comes with high confidence from TRM Labs, as ZachXBT traces stolen cryptocurrency from both Binance and Bitget breaches merging at identical wallet address.
Security experts in the cryptocurrency space from TRM Labs and Chainalysis, together with blockchain sleuth ZachXBT, have connected the massive $6.3 billion breach of Binance to the TraderTraitor organization operating out of North Korea.
The attack was attributed to the TraderTraitor collective by TRM Labs with "high confidence," based on intelligence gathered both on the blockchain and through traditional investigative channels.
Blockchain investigator ZachXBT indicated that cryptocurrency stolen during the Binance incident and from the previous Bitget security breach were mixed together at an identical wallet address following their movement via THORChain.
"This indicates the same actor is likely behind both incidents," he said, adding that the Bitget attack had been attributed to TraderTraitor.
Jonathan Levin, who serves as both co-founder and CEO of Chainalysis, similarly identified TraderTraitor as the culprit, noting that the organization made off with $6.4 billion, a figure marginally higher than the $6.3 billion loss Binance has publicly estimated.
"We assess Binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack," he said.
This attribution comes on the heels of a prior analysis conducted by Ido Ben-Natan, CEO of Blockaid, who informed Cointelegraph that the complexity of the attack combined with blockchain-based preparations bore hallmarks characteristic of North Korean cyber operations.
Federal authorities in the United States have connected TraderTraitor to several of the cryptocurrency industry's most significant heists, such as the Bybit security breach that occurred in February 2025. The FBI additionally collaborated with US and Japanese investigators to attribute the theft of over $300 million from DMM Bitcoin in May 2024 to these North Korean threat actors.
According to the FBI, TraderTraitor focuses its efforts on targeting employees of companies using social engineering tactics. In the incident involving DMM, a malicious actor impersonating a job recruiter transmitted a compromised coding assessment to a staff member working at wallet service provider Ginco. Investigators determined that the unauthorized access obtained was most likely exploited to alter a legitimate transaction request, redirecting cryptocurrency assets to wallets under the attackers' control.