Investigators link the $6.3 billion Binance hack to North Korea
TRM Labs and Chainalysis say a North Korean hacking group known as TraderTraitor is likely behind the attack, which Binance puts at $6.3 billion.

The facts
- Binance estimates the impact of the hack at $6.3 billion, while Chainalysis puts the amount taken at $6.4 billion, according to Cointelegraph.
- TRM Labs attributes the attack to the North Korean group TraderTraitor with "high confidence", and Chainalysis CEO Jonathan Levin said the same group was likely responsible.
- On-chain investigator ZachXBT found funds stolen from Binance mixed at the same address with proceeds from an earlier Bitget exploit, which suggests the same attacker.
- Binance says about $3 billion has been frozen on-chain and withdrawals remain paused, according to The Defiant. The attribution comes from private analytics firms, not an official government finding.
Case notes · Danny's take
Why it matters
Follow the wallets, not the headlines. If TraderTraitor is behind this, the playbook is already known: stolen funds get split, swapped and pushed through cross-chain routes until they are hard to trace. The $3 billion frozen is the part that matters most for users. The rest is now a race between investigators and the people laundering it.
For traders
Watch Binance's withdrawal restart and its reserve data. A smooth reopening would calm the market; delays or a rising loss figure would keep pressure on BNB and on exchange balances. Don't trade the attribution headline itself.
For builders
Bridges and swap services that carried the funds will face pressure to screen and freeze faster. If you run anything that touches cross-chain flows, tighten monitoring for wallets flagged by TRM Labs and Chainalysis.
Not financial advice. Do your own investigation.
This story was summarised with AI from Cointelegraph's reporting and checked against our editorial policy. Danny's take reflects his views. Disclaimer.
