Back to list

TRM Labs: North Korean Hackers Behind $6.36 Billion Binance Theft

2026-10-30 23:38

According to TechFlow, on October 30, Decrypt reported that blockchain analytics firm TRM Labs has attributed the Binance theft to North Korean hacker group TraderTraitor with high confidence, based on on-chain and off-chain intelligence.

TRM statistics show that the attacker moved approximately $6.36 billion in assets from Binance wallets across 10 blockchains, with amounts calculated at prices at the time of each transfer, and most funds moved within about 20 minutes.

TRM noted that characteristics such as small withdrawals from Tornado Cash before the attack to fund operational wallets, deploying attack code in advance, and obtaining signatures in advance before centralized execution are consistent with previous North Korea-linked attacks such as Bybit. The above conclusions represent the firm's investigative assessment.

Source: TechFlow