--- title: Researchers Link $6.3B Binance Hack to North Korea's TraderTraitor url: >- https://www.cryptocatalyst.news/articles/2026-10-30-researchers-link-63b-binance-hack-to-north-koreas-tradertraitor canonical: >- https://www.cryptocatalyst.news/articles/2026-10-30-researchers-link-63b-binance-hack-to-north-koreas-tradertraitor date: '2026-10-30T13:05:01.707474+00:00' category: general tags: - binance - hacking - north-korea - security - tradertraitor source: CoinDesk source_url: >- https://www.coindesk.com/policy/2026/10/29/crypto-s-longtime-foe-north-korea-s-lazarus-group-likely-behind-binance-hack-blockchain-sleuths sources: - name: CoinDesk url: >- https://www.coindesk.com/policy/2026/10/29/crypto-s-longtime-foe-north-korea-s-lazarus-group-likely-behind-binance-hack-blockchain-sleuths - name: CoinTelegraph url: >- https://cointelegraph.com/news/north-korea-linked-to-63b-binance-hack-by-crypto-investigators?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound - name: Decrypt url: >- https://decrypt.co/382224/trm-and-chainalysis-tie-6-4b-binance-hack-to-north-koreas-tradertraitor publisher: CryptoCatalyst summary: >- TRM Labs and Chainalysis link the $6.3B Binance hack to North Korea's TraderTraitor. Binance says it set aside $6.34B to cover user losses. image: >- https://www.cryptocatalyst.news/images/articles/2026-10-30-researchers-link-63b-binance-hack-to-north-koreas-tradertraitor.webp generated_by: automated editorial pipeline --- # Researchers Link $6.3B Binance Hack to North Korea's TraderTraitor Blockchain investigators attribute the roughly $6.3 billion Binance hack to TraderTraitor, a North Korean-linked group also associated with the Bybit attack. Binance says it has set aside $6.34 billion of its own funds to cover user losses, while investigators point to blockchain evidence connecting the stolen money to other hacks. ## Key takeaways - TRM Labs said it had high confidence that North Korea-linked TraderTraitor was behind the Binance hack. - Binance says it has set aside $6.34 billion of its own funds to cover user losses. - ZachXBT found stolen funds from the Binance and Bitget hacks converging at the same address. - TraderTraitor has also been blamed for the $1.5 billion Bybit hack. Blockchain investigators say North Korea-linked TraderTraitor was likely behind Thursday's attack on Binance, in which about $6.3 billion was stolen. TRM Labs said it had high confidence in the attribution, and Chainalysis also connected the hack to the group, according to reporting by CoinTelegraph and Decrypt. Binance says it has set aside $6.34 billion of its own funds to cover user losses. That figure is close to the reported value of the stolen assets, though the available reports do not explain the precise calculation or how reimbursements will work. ## What connects the Binance hack to TraderTraitor? Investigators cited blockchain transaction patterns in linking the attack to TraderTraitor, the North Korean group also blamed for the $1.5 billion Bybit hack. Independent blockchain investigator ZachXBT identified funds from the Binance and Bitget hacks converging at the same address, another connection researchers are examining. The attribution is based on analysis of crypto transactions, not a public admission by the attackers. Such evidence can show how funds move and where they meet, but identifying the people behind a wallet is a separate challenge. TRM's description of its finding as "high confidence" is an assessment, not a court ruling. ## What does Binance's $6.34B reserve mean for users? Binance says the money it has set aside is intended to cover losses for users. That is a significant assurance, but the reports do not spell out the claims process, eligibility rules, or payment timeline. Users affected by the breach should rely on Binance's official updates for those specifics and be wary of unsolicited recovery offers. The size of the alleged theft also puts this attack in a wider pattern: recent reports have tied North Korea-linked actors to major exchange breaches, including Bybit and Bitget. In Bitget's case, Chainalysis traced $387 million across four blockchains. For exchange customers, the practical lesson is that investigators may track stolen funds across networks, but tracing does not guarantee recovery; the clearest immediate detail here is Binance's stated plan to use its own funds to cover losses. ## FAQ ### Who do investigators say was behind the Binance hack? TRM Labs and Chainalysis linked the attack to TraderTraitor, a North Korea-linked group. TRM described its attribution as high confidence; it remains an investigator assessment, not a court ruling. ### How much did Binance say it set aside for user losses? Binance said it set aside $6.34 billion of its own funds to cover user losses. The reports do not detail the reimbursement process or timeline. ### What evidence links the Binance and Bitget hacks? Blockchain investigator ZachXBT identified stolen funds from both hacks converging at the same address. That transaction link is one piece of evidence investigators are examining. ## Sources This article synthesizes reporting from [CoinDesk](https://www.coindesk.com/policy/2026/10/29/crypto-s-longtime-foe-north-korea-s-lazarus-group-likely-behind-binance-hack-blockchain-sleuths), [CoinTelegraph](https://cointelegraph.com/news/north-korea-linked-to-63b-binance-hack-by-crypto-investigators?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound), [Decrypt](https://decrypt.co/382224/trm-and-chainalysis-tie-6-4b-binance-hack-to-north-koreas-tradertraitor), written by an automated editorial pipeline. See https://www.cryptocatalyst.news/editorial-policy. ## How to cite CryptoCatalyst.news, "Researchers Link $6.3B Binance Hack to North Korea's TraderTraitor", 2026-10-30, https://www.cryptocatalyst.news/articles/2026-10-30-researchers-link-63b-binance-hack-to-north-koreas-tradertraitor