SKN | North Korea-Linked TraderTraitor Group Linked to $6.3 Billion Binance Hack

Key Points:

• TRM Labs attributed the $6.3 billion Binance security breach to North Korea-linked hacking group TraderTraitor with high confidence, citing on-chain and off-chain intelligence.
• Chainalysis and on-chain investigator ZachXBT identified connections between the Binance incident and an earlier Bitget exploit, including stolen funds converging at the same blockchain address.
• The group has previously been linked by US authorities to major cryptocurrency thefts, including the 2025 Bybit hack and the 2024 DMM Bitcoin breach.

Investigators Link Binance Breach to TraderTraitor

The investigation into Binance’s estimated $6.3 billion security breach is increasingly pointing toward North Korea-linked hacking group TraderTraitor, as blockchain intelligence firms identify connections between the incident and previous cryptocurrency exploits.

TRM Labs attributed the attack to TraderTraitor with what it described as “high confidence,” based on a combination of on-chain and off-chain intelligence.

Chainalysis co-founder and CEO Jonathan Levin reached a similar assessment, saying the group was likely responsible because of connections to an earlier attack. Chainalysis estimated the stolen amount at approximately $6.4 billion, slightly above Binance’s reported $6.3 billion impact.

The attribution adds to growing evidence that the Binance incident may be connected to a broader pattern of cryptocurrency thefts associated with North Korean cyber operations. However, the assessments remain intelligence-based conclusions rather than a publicly established final determination of responsibility.

On-Chain Movements Connect Binance and Bitget Exploits

On-chain investigator ZachXBT identified another potential connection between the incidents after tracing funds associated with the Binance breach and an earlier Bitget exploit.

According to his investigation, funds from both incidents were commingled at the same blockchain address after moving through THORChain, a cross-chain liquidity protocol.

ZachXBT said the convergence indicated that the same actor was likely responsible for both incidents. He also noted that the earlier Bitget exploit had been attributed to TraderTraitor and that the group had been associated with other attacks, including the Kelp DAO exploit.

The movement of stolen assets across blockchain networks can provide investigators with important clues about relationships between separate incidents. Shared addresses, transaction patterns and fund-routing behavior can help identify connections even when attackers attempt to obscure the origin of assets.

Nevertheless, the presence of funds at a common address is an investigative indicator and does not independently establish the identity of the individuals controlling the wallets.

Attack Methods Resemble Previous North Korean Operations

The latest attribution follows an earlier assessment from Blockaid CEO Ido Ben-Natan, who said the sophistication of the Binance attack and its on-chain preparations resembled activity associated with North Korean threat actors.

The Binance investigation has also raised questions about how attackers gained access to the exchange’s internal systems. Preliminary findings pointed to a compromised DevOps engineer’s laptop, potentially allowing unauthorized access to an internal service and the submission of fraudulent withdrawal transactions.

Binance previously stated that it had found no evidence of a wallet private-key leak. The distinction suggests that the incident may have involved the misuse or compromise of transaction-signing infrastructure rather than the direct extraction of private keys.

This type of attack is consistent with a broader cybersecurity challenge facing cryptocurrency businesses: compromising legitimate access pathways can allow attackers to manipulate authorized systems without necessarily breaking the underlying cryptographic protections.

TraderTraitor’s History of Major Cryptocurrency Thefts

US authorities have previously linked TraderTraitor to several significant cryptocurrency thefts.

One of the most prominent incidents was the February 2025 Bybit hack, which the FBI attributed to North Korean actors. The theft became one of the largest reported cryptocurrency security breaches and prompted warnings to digital asset companies to monitor suspicious fund movements.

The group was also linked to the theft of more than $300 million from Japanese cryptocurrency exchange DMM Bitcoin in May 2024. The FBI worked with US and Japanese investigators to attribute that incident to North Korean actors.

According to the FBI, TraderTraitor frequently targets employees of cryptocurrency and technology companies through social engineering.

In the DMM Bitcoin case, an attacker reportedly posed as a recruiter and sent a malicious coding test to an employee of wallet provider Ginco. Investigators said the resulting access was likely used to manipulate a legitimate transaction request, redirecting funds to wallets controlled by the attackers.

The incident illustrates how attackers can exploit employee access and trusted business processes to reach systems responsible for managing digital assets.

Social Engineering Remains a Critical Security Weakness

The reported history of TraderTraitor highlights the importance of protecting employees and internal operational systems, not just blockchain infrastructure and private keys.

Cryptocurrency exchanges rely on interconnected environments involving developers, administrators, custodians, transaction-signing systems and external service providers. A compromise involving one of these components can create pathways to unauthorized financial activity.

Social engineering is particularly difficult to address because it targets human trust and routine business processes. Malicious recruitment messages, fraudulent software tests and impersonation attempts can provide attackers with access that conventional perimeter defenses may not detect immediately.

For exchanges and digital asset companies, stronger employee verification, restricted system permissions, secure development environments and transaction authorization controls remain important layers of defense.

Outlook

The growing convergence of intelligence from TRM Labs, Chainalysis, ZachXBT and other security researchers strengthens the case for investigating TraderTraitor’s involvement in the Binance breach. Connections to the Bitget exploit and the group’s previously reported operations provide additional context for understanding the attack. However, final attribution remains dependent on continuing investigations. The incident reinforces the need for cryptocurrency platforms to strengthen internal access controls, employee security practices and transaction-signing infrastructure against increasingly sophisticated attacks.