Key facts
- The $6.3 billion Binance hack has been linked to North Korea's TraderTraitor group.
- Funds stolen from Binance and Bitget were commingled at the same address, suggesting a single actor.
- TraderTraitor is linked to other major crypto thefts, including the Bybit hack in February 2025.
- The FBI attributed the theft of over $300 million from DMM Bitcoin in May 2024 to North Korean actors.
Cybersecurity researchers, including TRM Labs and Chainalysis, have linked the $6.3 billion hack of Binance to North Korea's TraderTraitor group with high confidence. Onchain investigator ZachXBT noted that funds stolen from Binance and the earlier Bitget exploit were commingled, suggesting the same actor was behind both incidents. Chainalysis CEO Jonathan Levin also pointed to TraderTraitor, estimating the group stole $6.4 billion. US authorities have previously linked TraderTraitor to other major crypto thefts, such as the Bybit hack in February 2025 and the DMM Bitcoin theft in May 2024.