TRM Labs: North Korean Hackers Behind Binance's $6.36 Billion Theft

on October 30, according to Decrypt, blockchain analytics firm TRM Labs has attributed the Binance theft to the North Korean hacker group TraderTraitor with high confidence, based on both on-chain and off-chain intelligence.

TRM statistics show that attackers withdrew approximately $6.36 billion in assets from Binance wallets across 10 blockchains, valued at the prices prevailing at the time of each transfer, with the majority of funds moved within approximately 20 minutes.

TRM noted that patterns such as small withdrawals from Tornado Cash prior to the attack to fund operational wallets, pre-deployment of attack code, and batch execution after pre-obtained signatures align with previous North Korea-linked attacks targeting platforms like Bybit. These conclusions are the result of the firm's own investigative analysis.