Two blockchain analysis firms have named the attacker behind the record theft from Binance. TRM Labs attributes the attack to TraderTraitor, which it calls "North Korea's elite hacking unit," and says it makes that judgment "with high confidence." Chainalysis also attributes it to the same group, an assessment it says was strengthened by finding stolen Binance funds mixed on-chain with proceeds from last month's Bitget theft, which had been attributed to North Korea.
TRM puts the haul at about $6.36 billion, taken from Binance wallets on ten blockchains on October 29, most of it in about 20 minutes. Chainalysis counts about $6.4 billion. Binance itself has not named an attacker. Its latest update says it has reserved more than $6.34 billion of company funds to cover the losses.
SaasBuzz reported this morning that Binance first said the hack may have started with a DevOps engineer's laptop, then found "additional points of breach." The attribution moves the story on: TraderTraitor is the North Korean unit best known for breaking in through the people and suppliers who build and run crypto software.
Jonathan Levin, Chainalysis' co-founder and chief executive, gave his firm's reading on X a little after midnight Eastern time, tying the theft to an earlier hack:
Post on X by @jony_levin
We live in unprecedented times. But DPRK are up to their old tricks. We assess @binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack. Industry partners have already frozen ~$3B and we @chainalysis continue to follow all of the funds
Why the theft is so large
By SaasBuzz's calculation, TRM's figure is 4.2 times the roughly $1.5 billion the FBI says TraderTraitor took from Bybit in February 2025, the previous record, and 3.5 times Bybit and the $308 million DMM Bitcoin theft combined. In April, TRM put North Korea's attributed crypto theft since 2017 at more than $6 billion in all. If TRM is right, one night at Binance roughly matched that count.
TRM counts about $2.7 billion frozen by stablecoin issuers and Arbitrum's Security Council as of 00:30 UTC on October 30, or 42% of the total. It says the attacker holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion, or 38%, "beyond any issuer's reach."
What TRM's trace says about the way in
On Ethereum, TRM says, the attacker used 50 pre-signed EIP-7702 authorizations to turn a Binance hot wallet into a sweeper it controlled. In the same half hour, Binance wallets on other chains, with different key types, sent funds to the attacker through ordinary signed transfers.
"In TRM's assessment, the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains," the firm writes. Binance "has yet to publish a root cause," it adds. That fits Binance's own account so far: a compromised laptop first, then more points of breach in what it called "a complex attack."
What Binance and the industry are saying
Binance's answer has been money. In a post on X at 10:55 UTC, it said $5 billion of the $6.34 billion it has reserved is already held in the exact tokens that were taken, and that it is buying the rest:
Post on X by @binance
Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds. The company has already publicly committed to cover losses through company funds in the prior announcement. Binance has already reserved over $6.34B of company funds to cover this incident. $5B of these funds are already held in the exact token assets that were impacted. We are completing the purchase of the remaining amount by buying token assets through market channels and OTC channels. We are doing this to match the format of the remaining token assets and address any asset shortfalls. This step can take longer because some tokens may have low liquidity and OTC settlement also takes time. We will share more progress as soon as we can. These figures do not include frozen or protected assets, which remain subject to ongoing recovery and verification. Currently, $3bn has been frozen, with thanks to our industry partners. We are working with partners and law enforcement to recover the frozen assets.We will continue to use company resources to cover confirmed shortfall and will provide further verified updates as recovery efforts progress. Ultimately, all user funds will be verified publicly through our Proof of Reserves. We will weather this storm. Thank you for the support.
Chainalysis wrote that the stolen funds are moving in laundering patterns it had not seen before:
Post on X by @chainalysis
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence. Read more: https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/
Changpeng Zhao, Binance's founder, argued on X that dollar size is not the only measure. He compared the theft with Mt. Gox and FTX, where nearly all users lost out, while calling it "a major disaster for the industry":
Post on X by @cz_binance
Saw a few discussions about size of hack, why impact to bitcoin price is small, etc. 👇 $6.3 billion is the biggest in USD terms, but not in BTC terms. MtGox was 650,000 BTC! Other important numbers to consider: % of bitcoin (in relation to BTC total supply), ie, market impact. MtGox is big there again at 5%+. Number of users impacted, and % of user assets impacted. MtGox (the largest CEX at the time) and FTX (not small) were all near 100% of users and their asseets. Most important: Who is impacted? Does the platform cover it all? (only one victim), as in recent two CEX cases and Binance. Obviously, still a major disaster for the industry, Binance (and me). It hurts, but we survive. Most importantly, we protect our users. (image from @MatthewRoszak)
Binance said on October 30 that it expected withdrawals to resume about 45 hours after its 08:47 UTC update, and it has promised a post-mortem.
TraderTraitor goes in through people and suppliers
The thefts and break-ins tied to the group show one entry point again and again: a person or a supplier with privileged access. A 2022 US government advisory described TraderTraitor's opening move as spearphishing staff "often working in system administration or software development/IT operations (DevOps)," with messages that "mimic a recruitment effort and offer high-paying jobs."
Target | Taken | Way in |
|---|---|---|
JumpCloud customers, June 2023 | None given | Spear phishing at JumpCloud, then code run through its agent at a customer |
DMM Bitcoin, May 2024 | $308M | A fake LinkedIn recruiter's coding test, sent to a wallet supplier's employee |
Bybit, Feb. 2025 | $1.5B | A Safe{Wallet} developer's laptop and its AWS session tokens |
Binance, Oct. 2026 | $6.36B | Not published; Binance says a laptop may be one |
Sources: Mandiant (JumpCloud; its UNC4899 "likely corresponds to TraderTraitor"), the FBI, Safe{Wallet} via The Hacker News, TRM and Binance.
What it means for teams that run developer machines and signing systems
None of the three earlier attacks needed a flaw in a smart contract. Each began with a trusted person's machine or a supplier's tool. If TRM's reading of Binance holds, the step that mattered was getting a signing system to approve transactions, which turns on who and what can ask it to sign.
The cases on the record point to checks any software company with privileged engineers can run now, crypto or not:
Treat recruiters' coding tests and strangers' requests to help debug a project as untrusted code, and keep them off machines that hold work credentials. The DMM entry point began with a fake pre-employment test the target ran, per the FBI; the Safe{Wallet} developer's machine was compromised through a downloaded Docker project, likely via social engineering, The Hacker News reported.
Assume a developer laptop's live sessions are worth as much as its password and second factor. Safe{Wallet} said the attackers hijacked AWS session tokens to get around multifactor authentication.
Count supplier agents that can run commands, such as device management and CI/CD runners, as a path into production. That is how the JumpCloud intrusion reached a customer.
Split signing by chain and wallet tier, and alert on unexpected requests. TRM says a request for many authorizations across a range of transaction counts "should be treated as an indicator of compromise."
The attribution remains the firms' judgment. Neither the FBI nor Binance has named the attacker publicly. When the FBI named TraderTraitor for Bybit, it did so five days after the theft.
