Who is TraderTraitor? North Korean hackers behind the $6.3-billion Binance hack

TraderTraitor, a North Korean state-backed hacking group linked to the Lazarus Group, is suspected of carrying out the record $6.3 billion Binance crypto heist. Investigators are tracing the stolen funds, while questions mount over how hackers breached the exchange

Thursday saw a hacker move roughly $6.36 billion out of Binance wallets across ten blockchains, which TRM Labs describes as the largest crypto theft on record.

TRM attributes it with high confidence to TraderTraitor. Binance, the world's largest crypto exchange, has not publicly named a culprit, and no government has formally attributed the attack yet.

But the evidence gathered by private investigators points in one direction.

What happened to Binance?

The theft unfolded over a few hours on Thursday evening. Most of the funds left in 20 minutes starting at 20:05 UTC. TRM says that is roughly four times the $1.5 billion Bybit hack of February 2025.

A second wave around 23:05 UTC reached Binance wallets on Avalanche and Polygon.

Binance estimated the total impact at around $6.3 billion. DefiLlama data show Binance held roughly $144 billion in assets before the hack, so the stolen funds equal 4 per cent of that.

Who is TraderTraitor?

TraderTraitor is the label US authorities give to a cluster of North Korean state- cyber activity aimed at the cryptocurrency industry. The name began as a US government codename in an April 2022 joint advisory by the FBI, CISA and the Treasury Department.

Japanese regulators have described the group as part of the broader Lazarus Group. CoinDesk also characterises it as a subunit of Lazarus.

Security vendors track the same activity under different names. The FBI links TraderTraitor to the aliases Jade Sleet, UNC4899 and Slow Pisces. Those names come from Microsoft, Google and Palo Alto Networks respectively.

The wider Lazarus Group dates back more than a decade. Lazarus gained notoriety in 2014 when it was accused of hacking Sony Pictures in retaliation for a film that mocked Kim Jong-un.

US authorities have accused North Korean hacking operations of stealing cryptocurrency to help fund the country's weapons programs.

How does TraderTraitor operate?

The group is known for patient, people-focused attacks rather than breaking cryptography.

According to a US government advisory, attackers send phishing messages on platforms like , Slack or Telegram to employees of crypto companies, especially those in DevOps, IT or system administration roles. The FBI says TraderTraitor targets company employees through social engineering.

The DMM Bitcoin case in Japan shows how this works in practice. According to the FBI, the attack began in late March 2024, when an attacker posing as a recruiter on approached an employee of Ginco, a Japanese wallet software company.

The victim was lured with a job proposal that required running malicious Python code from a GitHub page. The FBI, the Defence Department's Cyber Crime Center and Japan's National Police Agency attributed the theft of 4,502.9 bitcoin, $308 million, to TraderTraitor.

The group has also worked through the software supply chain. TraderTraitor compromised the JumpCloud platform through spear-phishing and used that access to push a malicious update to a handful of cryptocurrency industry customers.

It was also tied to a 2023 campaign involving malicious packages that GitHub acted against. The FBI has additionally linked TraderTraitor to the Alphapo ($60 million), CoinsPaid ($37 million) and Atomic Wallet ($100 million) breaches.

What happened during the Bybit heist?

The group's best-known operation before Binance was the Bybit theft. On February 21, 2025, Bybit disclosed a heist in which hackers took 401,346 ether, worth around $1.4 billion at the time.

Days later the FBI announced that North Korea was responsible, saying it refers to this activity as TraderTraitor.

The bureau warned that the actors were moving fast, converting some of the stolen assets to bitcoin and other assets spread across thousands of addresses on multiple blockchains.

The Bybit theft made up the bulk of the $2.02 billion in crypto stolen in 2025, according to CoinDesk. The Binance attack is roughly four times larger.

Why are investigators pointing to TraderTraitor?

TRM Labs says several features match earlier North Korea-linked heists, including Bybit and the KelpDAO hack of April earlier this year.

These include small Tornado Cash withdrawals funding an operator wallet, preparation that began well before the theft, and signatures obtained in advance and then executed in one burst.

TRM's timeline shows the planning. Preparation began at least 36 hours before the theft. The attacker's operator wallet received three small Tornado Cash withdrawals on the morning of October 28, then tested code on two wallets and rehearsed the final version on a third.

Other analysts reached similar conclusions. Chainalysis chief executive Jonathan Levin said his firm assessed that TraderTraitor likely carried out the attack, citing links to a hack.

A Chainalysis spokesperson separately told CNN the firm has high confidence that North Korea was responsible.

Blockchain investigator ZachXBT called the attacker "likely Lazarus," and Blockaid's chief executive said the tactics were consistent with operations seen from North Korea. ZachXBT also said funds from the Binance hack and an earlier Bitget exploit had been commingled through THORChain.

There are caveats. One person familiar with crypto investigations told CoinDesk the hack was not yet definitively attributed to Lazarus. That person noted that North Korean groups are usually faster and more efficient at moving and selling stolen funds than the Binance attacker was.

TRM itself notes that the laundering seen so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed Bybit. Binance has not publicly named any perpetrator.

How did the attack work?

Binance said its initial investigation suggests a compromised DevOps engineer's laptop, which gave an attacker access to a service container and let them submit unauthorised withdrawals. The exchange said it found no evidence that any wallet private key leaked.

TRM's on-chain analysis adds detail. On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled, with 50 pre-signed authorisations prepared in advance.

On the other nine chains, Binance wallets sent funds to the attacker through ordinary signed transfers. TRM judges that this points to a compromise of Binance's hot wallet signing infrastructure.

It notes the wallets span different chains, key types and signing schemes, yet all produced valid signatures within half an hour.

Put simply, the evidence suggests the attackers did not crack any single wallet. They appear to have gained the ability to make Binance's own systems authorise transfers on their behalf across many networks, which matches the group's long record of starting with a human target.

Did the funds get frozen in time?

The theft was a race, and the industry won part of it. Tether, Circle, Ripple and World Liberty Financial froze $2.67 billion in stablecoins.

Arbitrum's Security Council froze a further 8,426 ETH and 74.6 million ARB, bringing the total to roughly $2.7 billion. Binance's own late-Thursday update put the frozen total at $3 billion.

Tether's chief executive said his company had frozen over $1.57 billion in USDT, and Circle's chief executive said it had frozen over $800 million in USDC.

The attacker moved quickly to convert what could be frozen into assets that cannot. It sold 325 million USDT to market makers at a discount of more than 10 per cent in exchange for ether.

It also borrowed ether against USDT on Aave. The attacker still holds more than 420,000 ETH and 18,270 BTC, $2.4 billion in assets beyond any issuer's reach.

The bitcoin is being handled carefully. CoinDesk's trace found the 18,270 BTC sitting in 19 wallets, 17 of them holding exactly 1,000 BTC each, with none moved onward as of early Friday.

TRM expects the stage to involve cross-chain bridges, swap services and over-the-counter brokers, based on large thefts.

Recovery of frozen funds is also not automatic. A former federal prosecutor and Treasury official told CNBC that a freeze stops money from moving, and recovery then follows through legal process.

How has Binance responded to customer concerns?

Binance moved to reassure customers. The exchange said user funds are safe and that it will cover losses from its Secure Asset Fund for Users (SAFU) and company funds.

Co-CEO Yi He said SAFU is held entirely in bitcoin. SAFU was set up in 2018 and holds roughly $1 billion in bitcoin.

Binance suspended deposits and withdrawals, revoked the affected address authorisation and brought in law enforcement and blockchain intelligence firms. It says it will publish a technical post-mortem followed by an updated proof of reserves.

In a later update, Yi He said deposits were unaffected and that withdrawals were expected to resume within the 48 hours. That window runs to 04:17 UTC on November 1.

Former chief executive Changpeng Zhao said it looks like a hack and that, as a shareholder, he expects all user funds to be fully covered. Fundstrat's Sean Farrell said the breach does not currently appear to pose a significant solvency risk for Binance.

How did the cryptocurrency market react?

Bitcoin dropped 4.8 per cent to below $77,000, ether fell 5.7 per cent, and BNB declined 8 per cent. Market-wide liquidations of leveraged positions reached $1.5 billion, mostly long bets.

Experts expect lingering pressure. Standard Chartered's Geoffrey Kendrick told CoinDesk that the negative price action may have further to run, and that a new base is likely only after frozen assets are released and more details emerge.

He added that the episode could accelerate a shift toward decentralised exchanges. Polymarket separately suspended international trading after hackers drained more than $2.6 million from user accounts, and nothing in the reporting so far ties that incident to the Binance theft.

The spillover reached other platforms as well. CoinDesk reported that India's largest crypto exchange CoinDCX curbed futures trading after the incident and that institutional investors were rushing to pull funds from exchanges.

Binance is the largest incident in a year of heavy losses. Bitget lost over $350 million in a September exploit, followed by Liquid Network at $320 million, Drift at $295 million and Kelp at $293 million, according to DefiLlama data.

Blockaid's chief executive said North Korea-linked actors have been tied to several of the year's major hacks, including Kelp DAO, Bitget and Drift.

With inputs from agencies

who is tradertraitor north korean hackers behind 6 3 billion binance hack