Researchers at TRM Labs and Chainalysis, along with investigator ZachXBT, linked an estimated $6.3 billion Binance hack to North Korea’s TraderTraitor group. TRM Labs said its attribution was made with “high confidence”; Chainalysis CEO Jonathan Levin said the group likely carried out the hack and put the theft at $6.4 billion.
ZachXBT said stolen Binance funds and funds from an earlier Bitget exploit reached the same address after moving through THORChain. He said this suggested the same actor was likely behind both incidents, not that the link was confirmed. US authorities have previously linked TraderTraitor to other crypto thefts, including the Bybit hack in February 2025 and the theft of more than $300 million from DMM Bitcoin in May 2024.
