TRM and Chainalysis say with high confidence that TraderTraitor, linked to North Korea's Lazarus Group, is behind the Binance hack. The funds appear to have passed through the same wallets as the Bitget hack proceeds in September.
TraderTraitor is the name of a sub-unit of North Korea's state-linked Lazarus Group, known for being behind several of the largest crypto heists in recent years, including the 2025 Bybit hack. The group operates on behalf of the North Korean state, and stolen crypto funds have long been a key funding source for the country's weapons programs. The attribution is based on tracing transaction patterns and technical similarities with earlier attacks, not a confirmation from Binance itself.
Both TRM Labs and Chainalysis have independently concluded that TraderTraitor is behind the Binance hack. Both firms point out that the funds appear to have passed through the same wallets as the proceeds from the Bitget hack in September, an attack already linked to the same group. That provides independent technical support for the attribution, beyond the similarities in method.
According to TRM Labs, the attacker gained access by exploiting EIP-7702, a feature of Ethereum's Pectra upgrade that lets ordinary wallet addresses run as smart contracts. The attacker had pre-signed around 50 such authorizations across different nonce values, allowing their own code to run directly from one of Binance's hot wallets once the right authorization was activated.
As soon as the funds were out, they were moved on across around ten different blockchains within a few minutes, according to the analytics firms. The rapid spread across many networks is a known TraderTraitor pattern, making it significantly harder for exchanges and authorities to follow the money and freeze it in time.
To launder the funds, the attacker has, according to Chainalysis, among other things used the stolen assets as collateral for loans, sold parts of the holdings at a discount for faster settlement, and split larger bitcoin holdings into many smaller transactions to make the trail harder to follow.
The analytics firms estimate that around $3 billion of the stolen funds have been frozen so far, in cooperation with exchanges and blockchain partners. Most of the amount, however, remains under the attacker's control, and TRM and Chainalysis expect the work of tracing and freezing further funds to continue going forward.
Sources: TRM, Chainalysis
You have read what you can read for free. With an account you get unlimited access to all news and articles on kaupr.io — and become part of the network of investors, professionals and builders following onchain finance.