In this article5 sections
Investigators have tied the $6.3 billion exploit of Binance to TraderTraitor, a hacking group linked to North Korea, according to Cointelegraph. Blockchain analytics firm TRM Labs said it holds “high confidence” in the attribution, drawing on onchain and offchain intelligence.
Chainalysis co-founder and CEO Jonathan Levin also named the group. He put the loss slightly higher than Binance’s own figure, saying the theft amounted to $6.4 billion, and said the assessment rested on links to earlier hacks. TRM Labs published its attribution in a blog post on its own site.
Also read: Standard Chartered sees Bitcoin bottom; North Korea link in $36M hack; Iran deal may boost BTC
Key facts
- Onchain investigator ZachXBT said funds from the Binance breach and the earlier Bitget hack were commingled at the same wallet address after passing through the THORChain cross-chain swap protocol.
- Binance says about $3 billion of the stolen funds has now been frozen, with roughly $200 million of that frozen by Ripple, according to co-founder Yi He.
- Other freezes listed by Coinpedia include $27 million in USD1 and 48 million WLFI tokens, worth about $2 million, held by World Liberty Financial, and about $30.5 million locked by the Arbitrum Security Council through an onchain transaction.
- Binance’s initial investigation suggests a compromised DevOps engineer’s laptop gave an attacker access to a service container used to submit unauthorized withdrawal transactions.
- Deposits are working normally, but withdrawals remain paused while Binance rebuilds its withdrawal system and related addresses, with a restart expected within 48 hours.
How the attacker moved
Coinpedia reported that early onchain analysis points to EIP-7702, a feature introduced in Ethereum’s Pectra upgrade that lets an ordinary wallet behave like a smart contract for a short period when a request is signed with a valid private key. Researchers described the method as collecting 50 signed EIP-7702 authorizations in advance, each with a different sequential nonce, submitting all of them at once because the attacker could not know which nonce would be valid, and relying on a single match. One did.
Binance described the breach as having multiple factors and said its security team is tracing the full attack path through a compromised computer that may have been the entry point. The exchange promised a full report on the root cause.
Where the reports diverge
The accounts differ on scale and on how firmly the hack label is applied. Chainalysis said $6.4 billion was taken, while Binance’s estimated impact is $6.3 billion, as Cointelegraph noted. Crypto Briefing, reporting on October 29, said Binance had not formally declared a breach at that point and that founder Changpeng Zhao had said publicly the circumstances appeared to suggest a hack. Crypto Briefing also reported that Tether froze about $971 million in USDT and that Circle reportedly froze around $823 million in USDC, figures that sit alongside, rather than match, the roughly $3 billion total Binance now cites.
Market observers cited by Crypto Briefing reported roughly $450 million in long positions liquidated during the turmoil. Prices moved too: Cointelegraph’s editor’s choice list recorded BNB falling 8% and Bitcoin nearing $77,000.
Why it matters
For Binance users, the practical effect is that coins can be deposited but not withdrawn until the exchange finishes rebuilding its withdrawal system. Binance has said it will cover all hacking losses and that user funds are safe, and it has said it will share only confirmed freeze figures. Stablecoin freezes stop stolen tokens from moving, but they do not return them to their owners, so whether the locked funds are actually recovered is still unresolved.
The attribution also expands the list of major thefts that US authorities have pinned on TraderTraitor, which the FBI has previously linked to the February 2025 Bybit hack and to the theft of more than $300 million from DMM Bitcoin in May 2024. The FBI has said the group targets company employees through social engineering; in the DMM case, an attacker posing as a recruiter sent a malicious coding test to an employee of wallet provider Ginco.
What to watch
The near-term signal is the restart of Binance withdrawals, which the exchange said it expects within 48 hours. Its promised root-cause report, and any further freeze announcements from issuers or chains, will show how much of the $6.3 billion can be clawed back.
Reported by Cointelegraph.
Sources: Cointelegraph, Coinpedia, Crypto Briefing