TRM and Chainalysis Attributes $6.4B Binance Breach To TraderTraitor

TL;DR

• TRM Labs and Chainalysis attributed the Binance hack to the North Korean group TraderTraitor, which was also responsible for the attack on Bybit in 2025.
• Investigators identified transactions linked to the Bitget hack, the use of Tornado Cash, and thousands of transfers designed to move stolen funds between wallets.
• Binance set aside more than $6.34 billion of its own funds to cover the losses. Of that amount, $5 billion is already available in the same tokens that were stolen.

TRM Labs and Chainalysis attributed the theft of approximately $6.4 billion from Binance to the North Korean hacking group TraderTraitor, previously identified by the FBI as responsible for the $1.5 billion theft from Bybit in February 2025.

Both blockchain intelligence firms believe there is strong evidence linking the attacks. TRM Labs estimated the losses at $6.36 billion, while Chainalysis calculated a total of approximately $6.4 billion.

According to TRM, the attackers drained assets from Binance wallets across 10 blockchains. Most of the funds were transferred within approximately 20 minutes.

Chainalysis Links Binance Hack to North Korean Operations

Chainalysis identified funds stolen from Binance that were commingled with assets from the Bitget hack, which occurred the previous month and was attributed to North Korean operatives.

TRM Labs also found that the wallet used to prepare the attack had received funds through Tornado Cash, a cryptocurrency mixer. The firm identified similarities with the attacks on Bybit and KelpDAO.

On Ethereum, the attackers used an EIP-7702 delegation to turn a Binance hot wallet into a smart contract under their control. According to TRM, they prepared 50 signed authorizations before executing the attack.

On the other nine networks, the transfers were carried out through conventional signed transactions. Investigators believe these mechanisms point to a possible compromise of the infrastructure used to authorize transactions.

Binance initially investigated an engineer’s compromised computer, but later confirmed that it had identified additional entry points used during the breach.

Chainalysis also detected thousands of transactions executed within short periods, potentially using automated tools to distribute the assets across different addresses.

Exchange Sets Aside $6.34 Billion to Cover Losses

The exchange announced that it had set aside more than $6.34 billion of its own funds to compensate for the stolen assets. Of that amount, approximately $5 billion is already available in the same tokens affected by the breach.

The platform is acquiring the remaining tokens through market transactions and over-the-counter (OTC) deals. It warned that some purchases could take longer due to limited liquidity in certain assets.

Meanwhile, Tether, Circle, Ripple, and World Liberty Financial froze approximately $2.67 billion in stablecoins, according to TRM Labs.

The Arbitrum Security Council also froze 8,426 ETH and 74.6 million ARB. Binance estimates that the total value of frozen assets stands at approximately $3 billion.

Investigators also identified more than 420,000 ETH and 18,270 BTC controlled by the attackers, collectively valued at approximately $2.4 billion and beyond the reach of issuers’ asset-freezing mechanisms.

The exchange clarified that the $6.34 billion reserved to cover the incident does not include assets that have already been frozen.