Binance Hack: New Clues Point to North Korean Hackers

North Korea is believed to be behind the $6.3 billion hack suffered by Binance on October 29. TRM Labs attributes the attack to the TraderTraitor group with a high level of confidence. Crypto investigator ZachXBT found another clue: stolen funds from Binance and Bitget ended up at the same address. The platform has not yet confirmed the identity of the hackers.

TraderTraitor Becomes the Main Suspect of the Binance Hack

TRM Labs released its first findings on the October 29 attack. The blockchain analysis company identifies TraderTraitor, a hacker unit associated with the North Korean regime. The name is not new. In February 2025, the FBI had already attributed to this group the Bybit hack, estimated at $1.5 billion.

Binance represents a much larger operation. According to TRM Labs, the attackers moved $6.36 billion from Binance wallets spread across ten blockchains. Most of the funds were transferred within about twenty minutes, starting at 8:05 PM UTC.

The preparations had started at least 36 hours earlier. On October 28, a wallet used for the operation received three small transfers from Tornado Cash. The hackers then tested their setup on multiple addresses.

TRM Labs notes similarities with previous North Korean operations: early preparation, signatures obtained before the attack, and rapid execution of transfers. The company considers its attribution to TraderTraitor highly reliable. However, it specifies that it relies on intelligence derived from the blockchain and other sources.

Binance remains more cautious. Its first technical investigation mentions the possible compromise of a DevOps engineer’s computer. The hackers would thus have accessed a service container allowing unauthorized withdrawals to be submitted. The platform states that it found no evidence of private key leakage.

ZachXBT Finds Funds Linked to the Bitget Hack

It is another lead that could advance the investigation. ZachXBT claims to have found funds from the attacks on Binance and Bitget at the same address, after transfers passing notably through THORChain.

This protocol allows converting cryptocurrencies between different blockchains without going through a centralized platform. The connection is interesting since the previous attack on Bitget had already been linked to the TraderTraitor group.

In September, Bitget suffered a hack estimated at $387.5 million. The presence of funds from two attacks in the same wallet is a sign of coordination or the use of a common infrastructure. However, it does not by itself prove that the two operations were carried out by the same people.

ZachXBT favors this hypothesis. MistTrack investigators also detected TRX stolen from Binance that reportedly passed through Bitget Wallet Swap Bridge before reaching an address already used by Phemex hackers.

Connections between several hacks are starting to multiply. This scenario also recalls investigations conducted after the Bybit theft in 2025. ZachXBT had then identified a common address for stolen funds from Bybit and Phemex.

Hackers Would Still Hold $2.4 Billion

Technical investigations also provide details about the method used. On Ethereum, the attackers reportedly exploited EIP-7702, a mechanism introduced with the Pectra update in May 2025. This functionality allows a standard wallet to delegate certain operations to a smart contract.

According to TRM Labs, the hackers had 50 pre-signed authorizations. A single match with the transaction counter of the Binance wallet was enough to activate their malicious contract. Three minutes and 24 seconds later, the wallet transferred 167,464 ETH and 63 other tokens to an address controlled by the attacker.

Other Binance wallets simultaneously sent funds across several networks via validly signed transactions. TRM Labs suspects infrastructure compromise of the platform’s signing systems.

Meanwhile, stablecoin issuers tried to freeze the assets. Tether, Circle, Ripple, and World Liberty Financial immobilized about $2.67 billion. Arbitrum’s security council also intervened on ETH and ARB tokens, bringing the total frozen amount to nearly $2.7 billion in TRM Labs’s first report.

Binance then announced about $3 billion frozen on blockchains. However, the hackers would still hold more than 420,000 ETH and 18,270 BTC, valued together at approximately $2.4 billion at the time of analysis. Recovering these assets will be more complicated. Unlike centralized stablecoins, bitcoin and ether cannot be frozen directly by an issuer. The investigation therefore continues on two fronts: identifying those responsible and preventing the conversion of stolen funds. For Binance, attribution to TraderTraitor remains to be officially confirmed. However, the traces left between Bitget, Phemex, and Binance give investigators several concrete leads to follow.