TRM Labs attributed the Binance theft to North Korea’s Tradertraitor unit with high confidence, and investigator ZachXBT said the Lazarus Group was likely responsible. Neither assessment confirms responsibility, and no government has formally named a culprit. TRM valued the stolen assets at about $6.36 billion when they were taken; Binance’s preliminary findings pointed to a possible compromise of an employee’s laptop.
Binance said approximately $3 billion had been frozen. TRM estimated that the attacker still held more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion beyond issuer freezes. TRM expects further laundering through bridges, swap services and over-the-counter brokers.
