TRM links $6.36B Binance theft to North Korea’s TraderTraitor

Blockchain intelligence firm TRM Labs attributes the theft of about $6.36 billion from Binance wallets to North Korea’s TraderTraitor group, citing on-chain and off-chain evidence. The TRM analysis says most of the assets moved in about 20 minutes on October 29 across 10 blockchains. Binance has confirmed a security incident, but has not published a root cause or confirmed who was behind it.

What evidence links the theft to TraderTraitor?

TRM says its attribution is high confidence and points to preparation and fund movements that resemble earlier North Korea-linked thefts. The attacker’s operator wallet received small Tornado Cash withdrawals beginning October 28, and the theft followed testing and staging that TRM says began at least 36 hours before the transfers. TRM also identifies similarities to the February 2025 Bybit hack, which the FBI attributed to TraderTraitor.

Chainalysis separately assessed that the Binance attack was likely carried out by TraderTraitor, according to the Associated Press report. Those are intelligence firms’ assessments, not a public attribution by law enforcement. Binance said it was working with law enforcement to confirm the criminals’ identity.

How did the attacker move funds from the Ethereum wallet?

TRM’s account of the Ethereum activity centers on EIP-7702, an Ethereum transaction feature that lets an externally owned account authorize smart-contract code to act for it. Under the standard, a signed authorization delegates the account’s behavior to contract code until the account signs a new authorization. TRM says the attacker submitted one transaction containing 50 authorizations signed by a Binance hot wallet, each pointing to a sweeper contract controlled by the attacker.

The authorizations included consecutive account nonces. Because the wallet’s nonce advances with its transactions, a signature is valid only when its nonce matches the wallet’s current count. TRM says the batch made it likely at least one authorization would still match when submitted. After the delegation took effect, the attacker instructed the wallet to send its balance to an attacker-controlled address; TRM says that transfer moved 167,464 ETH and 63 tokens, including 1.615 billion USDT. The delegation remained active, allowing further sweeps when assets arrived.

TRM says the other affected wallets, across nine additional chains, sent funds through ordinary signed transfers rather than the Ethereum delegation. It assesses that the attacker most likely gained the ability to make Binance’s hot-wallet signing system authorize transactions across chains. That is TRM’s analysis of the on-chain evidence; Binance has not confirmed it.

What has Binance confirmed, and how much was frozen?

Binance’s preliminary investigation points to a compromised DevOps engineer’s laptop, which may have given an attacker access to a service container and the ability to submit unauthorized withdrawal transactions. The company said it found no evidence of a wallet private-key leak. Those findings do not yet establish how the attacker obtained the cross-chain signatures TRM observed.

Binance put the estimated impact at about $6.3 billion and said roughly $3 billion had been frozen with blockchain partners. TRM’s on-chain count, valued at the time each asset was taken, was about $6.36 billion; it counted roughly $2.7 billion frozen by issuers and network actors as of October 30 at 00:30 UTC. The figures use different cutoffs and reporting bases. Binance temporarily suspended deposits and withdrawals while it carried out security checks. The investigation remains open.

References

• TRM analysis — trmlabs.com
• Associated Press report — apnews.com