From Decrypt · By Decrypt Agent
In brief
TRM Labs and Chainalysis have both attributed the Binance hack to TraderTraitor, the North Korean group the FBI blamed for the $1.5 billion Bybit hack.
Chainalysis said it saw Binance funds commingling with proceeds of last month's Bitget exploit, which had been attributed to North Korean actors.
Binance said it has reserved more than $6.34 billion of company funds to cover losses, $5 billion of it already held in the affected tokens.
Three blockchain analytics firms have attributed this week's hack of Binance to North Korea, with two of the largest naming TraderTraitor, a North Korean hacking group, as responsible for what both describe as the largest crypto theft on record.
TRM Labs said it made the attribution "with high confidence," based on "robust on and off-chain intelligence." It put the theft at about $6.36 billion, moved out of Binance wallets on 10 blockchains, most of it in about 20 minutes from 4:05 p.m. ET on Thursday. That is about four times the $1.5 billion Bybit hack of February 2025, which the FBI attributed to the same group, TRM noted.
Chainalysis, which put the total at about $6.4 billion, said the strongest evidence came when its investigators saw funds stolen from Binance commingling in real time with funds from last month's Bitget exploit, which had been attributed to North Korean actors.
A Chainalysis spokesperson told CNN the firm had "high confidence" North Korea was behind the hack. Singapore-based Pangolin Intelligence also told CNN it believed a North Korean hacking unit was responsible, based on "analyzing the on-chain activity related to this hack and correlating with information gathered from previous known incidents." North Korea has previously denied hacking allegations.
TRM and Chainalysis both said the attacker's operational wallet was funded through Tornado Cash, a crypto mixer. TRM said that and other features, including staging that began well before the theft, matched earlier North Korea-linked attacks such as the Bybit hack and April's KelpDAO exploit.
Myriad: Where does ETH go next? Click to make your prediction.
How the attack worked
On Ethereum, the attacker used an EIP-7702 delegation, a feature introduced in Ethereum's Pectra upgrade that lets an ordinary wallet run smart contract code, to turn a Binance hot wallet into a sweeper it controlled, with 50 pre-signed authorizations prepared in advance, according to TRM. Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers. In TRM's assessment, that points to a compromise of Binance's hot wallet signing infrastructure.
Binance has said its investigation began with a compromised engineer's laptop, but has since uncovered "additional points of breach." The Bybit attack also began with a single compromised machine: North Korean hackers planted malicious code in the infrastructure of wallet provider Safe after compromising a Safe developer's computer, Decrypt reported at the time.