TRM Labs, Chainalysis, and ZachXBT have all pointed to signs of a connection between North Korea’s TraderTraitor group and the $6.3 billion Binance hack.

Cybersecurity researchers are narrowing down the suspects behind the Binance hack, a crypto asset theft estimated to have caused $6.3 billion in losses. Blockchain analytics firms TRM Labs and Chainalysis, along with on-chain investigator ZachXBT, have all identified signs linking the incident to TraderTraitor, a North Korean hacking group.

TRM Labs assessed with a high degree of confidence that TraderTraitor carried out the attack. Its conclusion was based on intelligence gathered from both on-chain and off-chain data.

Evidence from ZachXBT focuses on the flow of funds. According to the investigator, assets stolen from Binance and in the earlier Bitget exploit were transferred through the THORChain protocol before converging at the same wallet address. ZachXBT says this suggests the same actor was likely behind both incidents. The earlier Bitget attack was also attributed to TraderTraitor.

Jonathan Levin, Chainalysis co-founder and CEO, offered a similar assessment. He said the attack was likely carried out by TraderTraitor, based on its links to previous attacks. However, Chainalysis estimates the losses at $6.4 billion, slightly higher than the $6.3 billion figure.

These conclusions reinforce the initial assessment by Ido Ben-Natan, CEO of security firm Blockaid. He previously told Cointelegraph that the attack’s sophistication and its on-chain preparations bore similarities to the tactics used by North Korean hackers.

TraderTraitor’s familiar modus operandi

TraderTraitor is no stranger to US authorities. The group has been linked to some of the largest crypto asset thefts on record, including the February 2025 attack on Bybit. The US Federal Bureau of Investigation (FBI), working with investigators from the US and Japan, also attributed the theft of more than $300 million from the DMM Bitcoin exchange in May 2024 to a North Korean actor.

According to the FBI, TraderTraitor often targets corporate employees using social engineering techniques. In the DMM Bitcoin case, an individual posing as a recruiter sent a programming test containing malicious code to an employee of Ginco, a crypto asset wallet service provider. Investigators believe the access gained through this attack was likely used to manipulate a legitimate transaction request, redirecting assets to wallets controlled by the hackers.

This method could help explain the unanswered question in the Binance case: how the attacker obtained the signature needed to authorize the exchange’s hot wallet through Ethereum’s EIP-7702 feature. If confirmed, the incident would cement TraderTraitor’s position as the biggest threat to the crypto asset industry, with losses far exceeding Bybit’s record of approximately $1.5 billion.