Key Notes
- TRM Labs attributes the $6.36 billion Binance theft to North Korea’s TraderTraitor with high confidence.
- The FBI linked the same activity to earlier Bybit and DMM Bitcoin thefts, while the Binance attribution remains TRM’s assessment.
- Binance pledges full loss coverage as deposits operate normally and withdrawals remain paused.
North Korean hackers were behind the approximately $6.36 billion theft from Binance, according to TRM Labs. The blockchain intelligence firm attributes the operation to TraderTraitor with high confidence, an assessment reported by Reuters on October 30.
TRM describes the incident as the largest cryptocurrency theft on record. Its estimate covers transfers from Binance-attributed wallets across ten blockchains, with most of the funds moved in roughly 20 minutes. The attribution is TRM’s investigative judgment; the FBI notices discussed below concern earlier attacks.
What TRM Bases Its Attribution On
In its underlying analysis, TRM says the assessment draws on blockchain activity and intelligence from outside the blockchain. It identifies similarities to earlier North Korea-linked operations, including small Tornado Cash withdrawals funding an operator wallet, advance staging and signatures prepared before the theft.
The firm’s reconstruction puts preparation at least 36 hours ahead of the attack. It describes code being tested on separate wallets before use against Binance, followed by coordinated valid signatures across networks with different signing systems. TRM assesses that the attacker gained the ability to make Binance’s hot-wallet infrastructure authorize transfers.
The $6.36 billion figure values assets when they were transferred. Binance’s own rounded impact estimate is about $6.3 billion, so the two figures describe the same incident rather than separate losses. Our main Binance report covers the wallet mechanics, the company’s response and comparisons with earlier major hacks.
TraderTraitor Has Been Linked to Earlier Exchange Thefts
The name TraderTraitor already appears in official US investigations. In a February 26, 2025 public service announcement, the FBI attributed the approximately $1.5 billion Bybit theft to North Korea and used TraderTraitor to describe the activity. TRM’s Binance estimate is more than four times that amount.
A separate December 2024 statement by the FBI, the US Defense Department’s Cyber Crime Center and Japan’s National Police Agency linked TraderTraitor actors to the $308 million DMM Bitcoin theft in May 2024.
That statement described a fake recruitment approach to an employee of wallet-services company Ginco, a malicious programming test and subsequent misuse of the employee’s access. Those findings provide historical context for the group’s methods. They do not establish that the Binance intrusion used the same recruitment story or initial access route.
Binance’s Root-Cause Investigation Continues
Binance’s preliminary explanation points to a possible compromise of a DevOps engineer’s laptop, enabling access to a service container and unauthorized withdrawals. The exchange says it has found no evidence of wallet private-key leakage and will publish a detailed technical report after the facts are verified.
Compromising access to a signing service and extracting its private keys are distinct possibilities. TRM’s analysis of signed transactions does not settle that distinction on its own, and the company has not presented its preliminary laptop finding as a completed forensic account.
Binance says roughly $3 billion in affected assets has been frozen and pledges to cover all losses using SAFU and company funds. A freeze restricts movement; it does not by itself establish that the assets have been returned. Our Bitcoin-wallet follow-up explains the different recovery challenge for BTC, which has no issuer-operated freeze function.
The company’s later service update at 04:36 UTC on October 30 says deposits are operating normally while withdrawals remain paused. Binance expects withdrawals to resume within 48 hours as it strengthens the service’s security, with a full root-cause report still to follow.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
