Binance Hack Update: Chainalysis, TRM Labs, Others Blame North Korea for Biggest Crypto Theft

North Korea’s elite hacking group is behind the $6.3 billion Binance hack, according to many Blockchain analytics firms including TRM Labs and Chainalysis. The massive drain of multiple crypto assets from the exchange’s hot wallets is regarded as the largest crypto theft in history.

North Korea’s Lazarus Group Behind Binance Hack: Chainalysis

Blockchain intelligence firms and investigators have attributed Binance $6.3 billion hack on October 29 to North Korea’s TraderTraitor, a unit of the government-sponsored hacker group Lazarus Group.

Chainalysis began actively investigating the Binance exploit in coordination with industry partners. “At present we are monitoring funds moving across multiple blockchains, including Bitcoin, Ethereum, Tron, and a number of L2s,” it said.

Chainalysis CEO Jonathan Levin stated their analysis linked the largest crypto theft to North Korean hacker group TraderTraitor. This is due to commingling of funds with last month’s Bitget exploit.

“We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance,” Chainalysis stated. Levin also noted that crypto industry partners froze nearly $3 billion, with Chainalysis continuing to track the remaining funds.

We live in unprecedented times. But DPRK are up to their old tricks. We assess @binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack. Industry partners have already frozen ~$3B and we @chainalysis continue to follow all of the funds pic.twitter.com/9WiT5IZWbG

— Jonylevin (@jony_levin) October 30, 2026

TRM Labs and On-Chain Sleuths Point to TraderTraitor

TRM Labs also blamed TraderTraitor for moving $6.36 billion from Binance hot wallets across 10 blockchains in just 20 minutes.

Based on robust on and off-chain intelligence, TRM Labs claimed the attacker used Ethereum EIP-7702 to turn a Binance wallet into a sweeper it controlled. Hackers prepared 50 pre-signed authorizations in advance and executed them on other chains during the same 20-minute window.

TraderTraitor is responsible for the 1.5 billion Bybit hack in 2025 and the KelpDAO hack in April 2026. TRM highlighted matching patterns with earlier incidents. Almost $2.8 billion in stablecoins and other assets were frozen by issuers including Tether, Circle, and others.

On-chain investigator ZachXBT reported that stolen funds from the Binance hack and the earlier $388 million Bitget exploit were commingled at the same address after arriving via THORChain.This indicated that the same actor is likely behind both incidents.

BINANCE HACKER PREPARING TO LAUNDER FUNDS

The hacker just moved 17.26K $ETH ($38.82M) to a new wallet, preparing to launder funds via Tornado Cash and other mixers.

The attacker still holds 480.72K $ETH (~$1.08B) that cannot be frozen.

New wallet:… pic.twitter.com/FmG18g85hT

— Onchain Lens (@OnchainLens) October 30, 2026