Blockchain intelligence firm TRM Labs has attributed the $6.36 billion cryptocurrency theft from Binance to TraderTraitor, a North Korean hacking unit, saying its assessment is based on on-chain and off-chain intelligence.
TRM described its attribution as high confidence, although Binance has not publicly confirmed who carried out the attack.
In its technical analysis published on October 29, TRM said an attacker moved approximately $6.36 billion from Binance wallets across ten blockchains. Most transfers happened in about 20 minutes, beginning at 20:05 UTC. The affected networks included Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon.
TRM said the attacker used different methods across the networks. On Ethereum, the attacker used the EIP-7702 delegation feature to make a Binance hot wallet execute code controlled by the attacker. A transaction carried 50 pre-signed authorizations, allowing one to remain valid when it was processed. Three minutes and 24 seconds later, the wallet sent 167,464 ETH and 63 other tokens, including approximately $1.615 billion in USDT, to an attacker-controlled address.
Wallets on the other blockchains, as well as a separate Binance wallet on Ethereum, sent assets through ordinary signed transfers. TRM said the pattern points to a possible compromise of Binance’s hot-wallet signing infrastructure, which could have allowed the attacker to make the exchange’s systems approve transactions across several networks. The firm stressed that Binance has not yet published a confirmed root cause.
TRM linked the activity to TraderTraitor, a group associated with North Korea. The firm cited similarities in the preparation and transaction patterns, including small Tornado Cash withdrawals used to fund an operator wallet before the attack. The FBI previously identified TraderTraitor as responsible for the $1.5 billion Bybit theft in February 2025. Reuters independently reported TRM’s attribution on October 30.
According to TRM’s on-chain snapshot from October 30 at 00:30 UTC, the attacker still held more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion and beyond the reach of token issuers’ freezing controls. The firm counted about $2.7 billion in assets frozen on-chain by that snapshot. Binance’s own security update later put the amount frozen at approximately $3 billion.
Binance has not confirmed the identity of the attackers or published a full technical post-mortem. In its initial investigation into the breach, the exchange said a compromised DevOps engineer’s laptop may have provided access to a service container used to submit unauthorized withdrawal transactions. Binance said it had found no evidence that wallet private keys were leaked.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
In a further update posted by Binance’s verified news account on October 30, the exchange said deposits were operating normally while withdrawals remained paused as it overhauled the withdrawal service and affected addresses. Binance said it expected withdrawals to resume within 48 hours, while its security team continued tracing the attack path through the potentially compromised computer.
