Blockchain analytics firm Chainalysis has concluded that the North Korean cybercriminal group TraderTraitor carried out the $6.4 billion theft of cryptocurrency from Binance, in a report published on October 30. The firm's attribution rests on blockchain activity it says ties the Binance incident directly to an earlier hack of exchange Bitget.
"This group has repeatedly attacked the cryptocurrency industry, exchanges, DeFi protocols and investors to raise funds for the regime," Chainalysis said. Cybersecurity firm TRM Labs independently reached the same conclusion, pointing to both internal and external intelligence sources.
According to Chainalysis, the decisive clue was that assets stolen from Binance were mixed in real time with funds taken from Bitget, whose critical server was breached on September 24, 2026, in a theft worth $388 million. "That direct on-chain link reinforced our assessment that TraderTraitor carried out the Binance hack," the firm said.
The Binance theft began at 20:20 UTC on October 29, with the attacker draining the exchange's hot wallets. Investigators say the intruder then attempted to rapidly convert freezable stablecoins into bitcoin and ether before issuers could intervene, a move aimed at placing the funds beyond the reach of blacklisting tools.
Billions frozen, laundering tactics shift
The response from analytics firms and authorities was swift. Chainalysis said close to $2.8 billion has been frozen through coordinated action, while Binance put the current verified total at $3 billion. In the wake of that containment effort, Chainalysis said the attackers altered how they are moving the remaining funds.
"As investigators continue tracking the funds stolen from Binance, we are observing laundering patterns we had not seen before," the firm said. "Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of the funds." Chainalysis added that the funds are cycled repeatedly between addresses rather than simply moved forward: "Instead of simply moving the funds forward, they circulate them repeatedly between addresses, often sending them back to addresses previously involved in the sequence."
A compromised laptop
Binance's own preliminary investigation points to a more mundane entry point than sophisticated exploit code. The exchange says access was made possible through the breach of a DevOps engineer's laptop, which allowed attackers to enter a services container and execute unauthorized withdrawals. Binance has not disclosed further details on how the device was compromised.
For European exchanges and custodians, the case underscores a recurring theme in North Korea-linked operations: attackers increasingly target internal infrastructure and employee credentials rather than relying solely on smart-contract or protocol-level vulnerabilities, a pattern Chainalysis has documented across TraderTraitor's history of targeting exchanges, DeFi protocols and investors.
