Binance logo and stock graph are displayed in this illustration taken on June 28, 2021. Dado Ruvic/Illustration/Reuters
Private blockchain analysis companies TRM Labs and Chainalysis have both assessed that North Korean state-backed hackers were behind the recent breach of the Binance cryptocurrency exchange.
Binance first reported on Oct. 29 that about $6.4 billion in assets in cryptocurrency wallets on its platform had been targeted. The same day, TRM Labs published its own assessment alleging that a group dubbed TraderTraitor—which TRM identified as an elite North Korean state-sponsored hacking group—was responsible for the Binance breach.
TRM Labs said it relied on an array of information to attribute the attack and made its investigative conclusions with high confidence. The company said several characteristics of the Binance hack match past cybersecurity incidents attributed to North Korea-linked actors.
In a post on X, Chainalysis CEO Jonathan Levin said his company also suspects TraderTraitor and North Korea were behind the Binance attack.
TraderTraitor is suspected in other past cyberattacks. The FBI named the group and North Korea as the parties responsible for a hack targeting approximately $1.5 billion in assets on the Bybit cryptocurrency exchange in February 2025.
TRM Labs assessed that TraderTraitor was behind another cryptocurrency hack in April.
Chainalysis has also assessed TraderTraitor was behind a hack targeting the Bitget cryptocurrency exchange in September.
In an interview with CNN on Friday, Levin said the pattern in which assets were laundered once taken from targeted cryptocurrency exchanges can help investigators to identify the parties behind such attacks.
“The thing that we see is that sometimes there is reuse of some of the wallet infrastructure that is used in the laundering process, and that helps us tie back with high confidence the attribution to these actors,” Levin said.
According to an Oct. 30 report by Chainalysis, investigators found that funds taken in the latest Binance hack have been mixed in with funds stolen from the Bitget hack.
The hackers responsible for the latest Binance attack moved most of the $6.4 billion in assets out of targeted wallets on 10 blockchains in about 20 minutes, according to the TRM Labs report. It would represent the largest theft of crypto assets on record.
When reached for comment, a Binance spokesperson did not provide the company’s own assessment of which parties may have been behind the recent security incident.
“We are working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice,” the Binance spokesperson told The Epoch Times.
In its initial internal investigation of the hack, Binance assessed hackers had managed to compromise an engineer’s laptop and subsequently submit unauthorized withdrawal transactions from the platform.
An FBI spokesperson told The Epoch Times that the bureau is working with public and private partners in efforts to investigate the Binance hack.
Upon discovering the breach, Binance announced it had coordinated with other blockchain partners to freeze assets targeted on its platform. As of Thursday night, the cryptocurrency platform said it had frozen about $3 billion in assets.
The cryptocurrency platform is also reserving assets to cover those lost in the cyberattack.
As of a Friday update, Binance said it planned to unfreeze its platform and allow withdrawals to resume on Nov. 1.
