Blockchain intelligence firm TRM Labs attributed the theft of assets from Binance hot wallets to North Korea-linked group TraderTraitor, adding an intelligence assessment to the exchange’s $6.3 billion loss estimate.
Binance said unauthorized withdrawals began at about 4:05 p.m. ET (20:05 UTC) Oct. 29. TRM tracked about $6.36 billion in transfers from wallets it associated with Binance across 10 blockchains, with most movement occurring in about 20 minutes. The firm valued the assets at about $6.36 billion when they moved and about $6.23 billion at prices current when it reported Oct. 30. Binance gave a separate loss estimate of about $6.3 billion.
TRM said its attribution drew on blockchain activity and other intelligence. Chainalysis co-founder and CEO Jonathan Levin also assessed that TraderTraitor was likely responsible, citing links to an earlier hack. Binance has not named a perpetrator and said its investigation was continuing.
The Federal Bureau of Investigation (FBI) attributed the Feb. 21, 2025, theft of about $1.5 billion from Bybit to North Korea and used the name TraderTraitor for that activity. That finding concerned the Bybit attack, not Binance’s incident.
Binance said about $3 billion had been frozen on-chain as of its Oct. 30 update. It said it would cover the loss through its Secure Asset Fund for Users and corporate treasury, and that customers would not bear the financial impact. The exchange had set aside more than $6.34 billion, including $5 billion in affected assets, and said it was acquiring the remainder. EconoTimes previously covered Binance’s reserve allocation.
In its update at 3:33 p.m. ET (19:33 UTC) Oct. 30, Binance said withdrawals were temporarily suspended during security reviews; deposits and other unaffected services continued. The exchange said a laptop compromise was considered early in the investigation, while later reviews raised other possible entry points. Binance said investigators had not detected access to wallet private keys. TRM assessed that attackers may have reached the process used to authorize hot-wallet transfers, but Binance had not published a root cause in the cited update.
Binance said it planned a Proof of Reserves snapshot, with results expected by Nov. 2.
