North Korea is believed to be behind the $6.3 billion hack suffered by Binance on October 29. TRM Labs attributes the attack to the TraderTraitor group with high confidence. Crypto investigator ZachXBT discovered another clue: funds stolen from Binance and Bitget allegedly ended up at the same address. The platform has not yet confirmed the identity of the hackers.
In brief
- TRM Labs attributes the Binance hack to the North Korean group TraderTraitor.
- ZachXBT links funds stolen from Binance to those from the Bitget hack.
- Around $2.7 billion was blocked according to TRM Labs’ first assessment.
TraderTraitor becomes prime suspect in Binance hack
TRM Labs has released its initial findings on the October 29 attack. The company specializing in blockchain analysis refers to TraderTraitor, a hacker unit associated with the North Korean regime. The name is not new. In February 2025, the FBI had already attributed the Bybit hack, estimated at $1.5 billion, to this group.
Binance represents a much larger operation. According to TRM Labs, attackers moved $6.36 billion from Binance wallets across ten blockchains. Most of the funds left in about twenty minutes, starting at 8:05 p.m. UTC.
Preparations had begun at least 36 hours earlier. On October 28, a wallet used for the operation received three small transfers from Tornado Cash. The hackers then tested their device on several addresses.
TRM Labs notes similarities with previous North Korean operations: advance preparation, signatures obtained before the attack and rapid execution of transfers. The company considers its attribution to TraderTraitor highly reliable. However, it specifies that it relies on information from the blockchain and other sources.
Binance remains more cautious. His first technical investigation mentions the possible compromise of a DevOps engineer’s computer. The hackers would have accessed a service container allowing them to submit unauthorized withdrawals. The platform claims to have found no evidence of private key leaks.
ZachXBT finds funds linked to Bitget hack
This is another avenue that could advance the investigation. ZachXBT claims to have found funds from the attacks against Binance and Bitget at the same address, after transfers notably via THORChain.
This protocol allows cryptocurrencies to be converted between different blockchains without going through a centralized platform. The connection is interesting since the previous attack against Bitget had already been associated with the TraderTraitor group.
In September, Bitget suffered an estimated $387.5 million hack. The presence of funds from two attacks on the same wallet constitutes an indication of coordination or use of a common infrastructure. However, it does not prove, in itself, that the two operations were carried out by the same people.
ZachXBT favors this hypothesis. MistTrack investigators also spotted TRX stolen from Binance allegedly passing through Bitget Wallet Swap Bridge before reaching an address already used by Phemex hackers.
Connections between several hacks are starting to multiply. This scenario is also reminiscent of the investigations carried out after the theft of Bybit in 2025. ZachXBT then identified a common address for the funds stolen from Bybit and Phemex.
Hackers would still keep $2.4 billion
The technical investigations also provide details on the method used. On Ethereum, attackers reportedly exploited EIP-7702, a mechanism introduced with the Pectra update in May 2025. This functionality allows a classic wallet to delegate certain operations to a smart contract.
According to TRM Labs, the hackers had 50 authorizations signed in advance. A single match to the Binance wallet transaction counter was enough to activate their malicious contract. Three minutes and 24 seconds later, the wallet transferred 167,464 ETH and 63 other tokens to an address controlled by the attacker.
Other Binance wallets have simultaneously sent funds across multiple networks using validly signed transactions. TRM Labs suspects infrastructure compromise signature of the platform.
Meanwhile, stablecoin issuers attempted to block the assets. Tether, Circle, Ripple and World Liberty Financial have tied up around $2.67 billion. The Arbitrum Security Council also intervened on ETH and ARB tokens, bringing the total amount blocked to almost $2.7 billion in TRM Labs’ first balance sheet.
Binance then announced around $3 billion frozen on blockchains. The hackers, however, would keep more than 420,000 ETH and 18,270 BTC, together valued at approximately $2.4 billion upon analysis. Recovery of these assets will be more complicated. Unlike centralized stablecoins, bitcoin and ether cannot be frozen directly by an issuer. The investigation is therefore continuing on two fronts: identifying those responsible and preventing the conversion of the stolen funds. For Binance, the attribution to TraderTraitor remains to be officially confirmed. The traces left between Bitget, Phemex and Binance nevertheless give investigators several concrete leads to follow.
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
