Chainalysis links Binance exploit to North Korea’s TraderTraitor
News
Chainalysis said the $6.4 billion Binance hack was likely carried out by North Korea-linked TraderTraitor, with about $2.8 billion frozen so far.
Chainalysis said it assesses the $6.4 billion Binance hack to be the work of North Korea-linked cybercrime group TraderTraitor, describing the attack as the largest in crypto history and one of the biggest financial crimes ever recorded. The firm said its conclusion was based on on-chain activity observed in the hours after the Oct. 29 breach and on a direct link between funds stolen from Binance and funds stolen in last month’s Bitget exploit.
How the breach unfolded
According to Chainalysis, funds began leaving Binance hot wallets across multiple blockchains at about 4:20 p.m. Eastern Time on Oct. 29. On Ethereum, the attacker used an operational wallet funded through Tornado Cash to submit valid signed authorizations that allowed a Binance hot wallet to run attacker-deployed code, after which assets were swept into attacker-controlled addresses. Across the affected blockchains, Chainalysis said the unauthorized transfers totaled approximately $6.4 billion.
The firm said the attacker then tried to move quickly before stablecoin issuers could freeze funds. It said about $500 million of stablecoins was routed into a wallet designed to swap freezable assets into non-freezable ones. Over nearly 20 minutes, that wallet swapped $325 million in stablecoins into $285 million in ether, while the remaining $175 million was sent to stopover wallets about 10 minutes later. Chainalysis said freezes began by 5:14 p.m. Eastern Time.
Why Chainalysis points to TraderTraitor
Chainalysis said several laundering patterns initially suggested TraderTraitor was responsible, but the strongest evidence came when investigators saw funds stolen from Binance commingling with funds stolen in the Bitget exploit, which had already been attributed to North Korean actors. Chainalysis said that on-chain link strengthened its assessment and that it announced the attribution on Oct. 30 at 12:30 a.m. Eastern Time.
The company also said the laundering pattern appears highly automated. It reported thousands of transactions in a short period, with addresses repeatedly cycling funds among themselves, sometimes sending them back to earlier addresses in the sequence. Chainalysis said many addresses followed a consistent pattern of receiving exactly 1 TRX, then additional funds, and then forwarding the assets onward, which it said suggests a programmatic process.
Response and remaining uncertainty
Chainalysis said about $2.8 billion has been frozen so far, but stressed that the investigation remains ongoing and that stolen funds are expected to keep moving in the coming days. It said it is sharing investigative leads with industry partners and law enforcement to help identify and freeze assets before they move beyond issuers’ control.
The report did not identify a final recovery total, and the broader attribution to North Korea should be read as an intelligence assessment from blockchain analysts rather than a confirmed law-enforcement conclusion. Chainalysis also noted that crypto exchanges remain attractive targets because they hold substantial funds, and said it will continue monitoring the flow of funds and updating labels as new information emerges.
