Attribution evidence file

The Federal Bureau of Investigation (FBI) said on Saturday that North Korea was responsible for the attack.

The FBI said it had observed hackers converting stolen assets into a type of cryptocurrency called Ethereum and that it is expected that the assets will then be converted again using decentralised finance and instant swap services.

On October 31, the FBI attributed the theft to TraderTraitor, its name for a North Korean state-sponsored hacking group. This confirms Elliptic's earlier assessment.

The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."

The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.

FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.

Three analytics firms link the attack to North Korean state actors.

Three analytics firms think so: two attribute the theft to TraderTraitor , a North Korean hacking unit, and the third calls it likely .

Stolen Binance funds were seen mixing, in real time, with funds from last month's Bitget theft, which had already been attributed to North Korean actors, and one firm calls that its strongest evidence. Funds from both thefts reached the same Ethereum address , as ZachXBT first reported.

The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster.

04:30 | First public attribution to TraderTraitor.

The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget

The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster.

None of this is proof, and the most careful reading explains why. The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster. The laundering through market makers and lending protocols doesn't match the older pattern either, and the root cause is still unpublished, which that firm calls "the most diagnostic fact still missing."

Finally, no government has confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days .

Download every address our investigators have linked to the Binance hack as a single CSV file.

Very few actors could coordinate an attack across 11 blockchains in around three hours.

The two sets of funds have now been combined in several wallets, and the amount has grown overnight. The link was first reported by ZachXBT.

Elliptic also cautioned that the onchain overlap with the Bitget incident involved only a small portion of the Binance funds and did not conclusively establish that the same attackers were responsible.

Elliptic has identified common service usage between those laundering the Binance funds and those behind three earlier thefts attributed to TraderTraitor, from BigONE, WOO X and AFX.

The long preparation, the apparent targeting of staff and the use of Binance's own systems to sign transactions resemble earlier TraderTraitor thefts, including Bybit.

The FBI has previously attributed the Bybit and DMM Bitcoin thefts to TraderTraitor.

On attribution, TRM states high confidence that this is TraderTraitor, the North Korean unit the FBI named for Bybit, on the basis of on-chain and off-chain intelligence it has not published.

Elliptic says likely, and lists its reasons: a laundering address shared with the September Bitget theft, 0x1510…feb7, although only about 39,000 dollars of Binance funds reached it against 510,000 linked to Bitget;

the preparation pattern of Tornado Cash funding, rehearsal and pre-signed bursts seen in Bybit and in KelpDAO in April; the targeting of staff, which matches the DMM Bitcoin case; and the capability to drain eleven chains in three hours.

Elliptic also lists the caveats: the shared address could be a launderer serving several clients, the stablecoins were held longer than North Korea usually holds them, the cash-out went through market makers and lending rather than bridges, and no government has said a word, whereas the FBI attributed Bybit within five days. Binance has named nobody.

My view is that the pattern fits and that a compliance team should act on it today rather than wait for a press release.

In Bybit, Sygnia traced the loss to a compromised developer workstation at the wallet provider, stolen cloud session tokens and a tampered signing interface. Same playbook, different entry. Precedent is not evidence, but it is a very good search warrant.

TRM, in a post on its website Thursday, attributed the attack to TraderTraitor, which it described as North Korea's elite hacking unit. "We make this judgment with high confidence," the firm said.

"Several features of this attack match earlier North Korea-linked heists, including the Bybit hack," TRM said.

TRM attributes this attack to TraderTraitor, North Korea’s premier hacking unit. We base this assessment on robust on and off-chain intelligence sources.

Experts, such as TRM Labs, quickly attributed the extraordinary $6.3bn Binance cryptocurrency theft to TraderTraitor, an elite North Korean hacking unit that has also been known as the Lazarus Group.

North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence.

TRM cited similarities to previous North Korean operations, including Tornado Cash funding, advance staging and pre-signed authorizations.

Chainalysis attributes the hack to TraderTraitor, a North Korean cybercrime group.

That direct on-chain link strengthened our assessment that TraderTraitor carried out the Binance hack and we announced it on October 30, 12:30am Eastern Time.

The strongest evidence emerged when Chainalysis investigators observed, in real time, funds stolen from Binance commingling with funds stolen in last month’s Bitget exploit, which had been attributed to North Korean actors.

Binance hasn't named a culprit. Teng said the investigation has not attributed responsibility to any individual, and Binance says it is working with law enforcement to confirm who is behind it.

“Our investigation has not attributed responsibility to any individual,” he wrote.

In a separate post, onchain investigator ZachXBT said the stolen funds from the Binance attack and the earlier Bitget exploit were commingled in the same address on Friday, after arriving via THORChain.

“This indicates the same actor is likely behind both incidents,” he said.

Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago, after arriving via THORChain. This indicates the same actor is likely behind both incidents.

The Bitget exploit was attributed to DPRK-linked

Blockchain analysis company Chainalysis also believed the Binance hack was "likely done by DPRK group TraderTraitor," its co-founder and CEO Jonathan Levin wrote on X.

Chainalysis co-founder and CEO Jonathan Levin said the Binance hack was likely carried out by North Korean hacking group TraderTraitor , citing links to a previous hack. In a post on X, Levin put the theft at $6.4 billion, slightly above Binance’s estimated $6.3 billion impact.

We assess @binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack.

TRM said it makes its North Korea judgment “with high confidence”, based on on-chain and off-chain intelligence.

Binance has not named a culprit. North Korea has denied involvement in hacks in the past

“We think North Korea is likely responsible,” Tom Robinson, chief scientist and cofounder of Elliptic, tells WIRED.

“Binance says the attack began with a compromised engineer’s laptop. Targeting crypto company staff is a TraderTraitor hallmark,” Elliptic’s Robinson says.

they had robust intelligence pointing to North Korean state-backed hacking unit the Lazarus Group, also known as TraderTraitor

We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.

The attack, the largest in crypto history, began at 8:04 pm UTC Thursday and the perpetrators, linked to the same North Korean hackers behind last month’s Bitget hack, immediately began converting assets.

US President Donald Trump, asked on Friday whether North Korean hackers were behind the theft, said he did not know but his administration is looking into it.

Ben-Natan also said the activity resembled operations linked to North Korea, citing Blockaid’s familiarity with those attacks. He pointed to sophisticated onchain preparations but emphasized that the attribution remained unconfirmed.

Before Binance’s latest update, Arkham CEO Miguel Morel told Cointelegraph there was insufficient information to determine whether the attack involved stolen keys or compromised infrastructure. “From what we can tell, it appears the hack is still ongoing,” he said at the time.

TraderTraitor emerged from Lazarus, a group working from North Korea’s Reconnaissance General Bureau, a military intelligence agency.

Neither Binance nor law enforcement officials have named any suspected links between the attack and North Korean hackers.

The bulk of the Binance heist unfolded in around 20 minutes beginning late on Thursday and bore similarities to previous large attacks blamed on North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis.