Crypto tracing firm TRM Labs has attributed the massive Binance hack to TraderTraitor, a North Korean hacking group, according to Reuters. The attackers drained roughly $6.36 billion from Binance wallets across at least 10 blockchains, with most of the funds moved in a window of about 20 minutes on October 29.
The theft is believed to be the largest crypto heist in history. Binance quickly suspended deposits and withdrawals and says it is working with law enforcement to identify those responsible. About half of the stolen funds have been frozen so far, but much of the rest may be gone for good.
How the Binance hack unfolded
According to TRM Labs, preparation for the attack began at least 36 hours in advance. The operator tested code on two wallets early on October 29, rehearsed the final version on a third wallet, and then routed the test funds back to itself. Four hours after that rehearsal, the same code was installed on a Binance hot wallet — an internet-connected wallet used to process customer withdrawals.
Wallets on Ethereum, Bitcoin, Tron and Solana were among those drained, with funds sent to multiple addresses controlled by a single attacker, TRM said. Binance's initial investigation pointed to a compromised laptop, but the company later said it uncovered additional points of breach. It has promised to cover all losses from the hack.
TraderTraitor: North Korea's crypto specialists
Neither Binance nor law enforcement has officially named North Korea as the culprit, but three crypto tracing firms have linked the attack to TraderTraitor. TRM Labs and Chainalysis both say they believe the group may be behind the heist, while Elliptic says it sees overlaps in the activity without tying it specifically to the group.
Chainalysis says its strongest evidence came when investigators watched stolen Binance funds mix in real time with funds from last month's Bitget exploit, which had already been attributed to North Korean actors. Elliptic's Tom Robinson noted that targeting a crypto company employee's laptop is a TraderTraitor hallmark, and that the attacker funded their wallet through Tornado Cash and rehearsed the attack in advance, as in the Bybit hack.
