TRM estimated that $6.36 billion in funds moved from Binance wallets, while it and Chainalysis separately linked the attack to North Korea, underscoring the breach's scale as withdrawals remained suspended.
TRM said the transfers crossed 10 blockchains, with most of the movement occurring in about 20 minutes. The firm attributed the activity to TraderTraitor, which it described as a North Korean hacking unit, and said the scale would make the incident the largest cryptocurrency theft on record.
Jonathan Levin, co-founder and CEO of Chainalysis, wrote on social media that TraderTraitor likely carried out the attack. TRM said it saw features in the Binance incident that it had also observed in the February 2025 Bybit breach. The Federal Bureau of Investigation (FBI) attributed that $1.5 billion theft to North Korea and TraderTraitor.
CBS News reported that experts view crypto theft and other cybercrime as sources of foreign currency for North Korea and funding for its nuclear program amid U.N. sanctions.
Binance said blockchain partners helped freeze about $3 billion in affected assets and pledged to cover all losses. The exchange said deposits remained available Friday, while withdrawals were halted; it expected them to resume within one or two days. EconoTimes previously covered Binance's withdrawal pause and its incident impact estimate.
Binance said its review found no indication that wallet private keys had been exposed. The exchange described a laptop as one possible starting point in the inquiry and said its later review identified additional suspected breach points. EconoTimes earlier reported on the possible laptop entry route behind unauthorized withdrawal requests.
CBS News reported that Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, questioned Binance's approval controls. “This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet,” Gan said. Binance said it would publish technical details when its investigation is complete.
