TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor
Both firms blame the group behind the Bybit hack, as Binance says it has set aside $6.34 billion of its own funds to cover user losses.
Blockchain intelligence firms TRM Labs and Chainalysis have both attributed a $6.4 billion hack of Binance to North Korea's TraderTraitor hacking group, the same state-sponsored collective held responsible for the $1.5 billion Bybit breach earlier this year. In response to the incident, Binance has confirmed it has set aside $6.34 billion of its own funds to cover potential user losses stemming from the attack.
TraderTraitor is a sophisticated North Korean cybercrime operation with a documented history of targeting cryptocurrency exchanges and financial platforms. The group has been linked to multiple high-profile heists in recent years and is widely believed to operate under the direction of the Lazarus Group, a hacking collective with alleged ties to the North Korean government. The Bybit hack, which occurred in early 2025, brought the group renewed international scrutiny.
The scale of the Binance incident raises serious concerns about the security infrastructure of even the world's largest cryptocurrency exchanges by trading volume. The willingness of Binance to deploy its own capital to protect users may offer short-term reassurance to retail investors, but the episode is likely to intensify regulatory conversations around exchange security standards and custodial responsibilities across the industry.
Investigators and law enforcement agencies are expected to continue tracking the movement of stolen funds, as TraderTraitor has previously attempted to launder assets through mixers and decentralized protocols.
Source: Decrypt
