Statements

Stolen Binance funds were seen mixing, in real time, with funds from last month's Bitget theft, which had already been attributed to North Korean actors, and one firm calls that its strongest evidence. Funds from both thefts reached the same Ethereum address , as ZachXBT first reported.

Three analytics firms think so: two attribute the theft to TraderTraitor , a North Korean hacking unit, and the third calls it likely .

Blockchain analysis company Chainalysis also believed the Binance hack was "likely done by DPRK group TraderTraitor," its co-founder and CEO Jonathan Levin wrote on X.

"Several features of this attack match earlier North Korea-linked heists, including the Bybit hack," TRM said.

The FBI has previously attributed the Bybit and DMM Bitcoin thefts to TraderTraitor.

The long preparation, the apparent targeting of staff and the use of Binance's own systems to sign transactions resemble earlier TraderTraitor thefts, including Bybit.

Elliptic has identified common service usage between those laundering the Binance funds and those behind three earlier thefts attributed to TraderTraitor, from BigONE, WOO X and AFX.

The two sets of funds have now been combined in several wallets, and the amount has grown overnight. The link was first reported by ZachXBT.

Very few actors could coordinate an attack across 11 blockchains in around three hours.

“We think North Korea is likely responsible,” Tom Robinson, chief scientist and cofounder of Elliptic, tells WIRED.

Neither Binance nor law enforcement officials have named any suspected links between the attack and North Korean hackers.

The strongest evidence emerged when Chainalysis investigators observed, in real time, funds stolen from Binance commingling with funds stolen in last month’s Bitget exploit, which had been attributed to North Korean actors.

Chainalysis attributes the hack to TraderTraitor, a North Korean cybercrime group.

TraderTraitor emerged from Lazarus, a group working from North Korea’s Reconnaissance General Bureau, a military intelligence agency.

Experts, such as TRM Labs, quickly attributed the extraordinary $6.3bn Binance cryptocurrency theft to TraderTraitor, an elite North Korean hacking unit that has also been known as the Lazarus Group.

“Our investigation has not attributed responsibility to any individual,” he wrote.

North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence.

TRM attributes this attack to TraderTraitor, North Korea’s premier hacking unit. We base this assessment on robust on and off-chain intelligence sources.

“This indicates the same actor is likely behind both incidents,” he said.

In a separate post, onchain investigator ZachXBT said the stolen funds from the Binance attack and the earlier Bitget exploit were commingled in the same address on Friday, after arriving via THORChain.

The Bitget exploit was attributed to DPRK-linked

Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago, after arriving via THORChain. This indicates the same actor is likely behind both incidents.

That direct on-chain link strengthened our assessment that TraderTraitor carried out the Binance hack and we announced it on October 30, 12:30am Eastern Time.

04:30 | First public attribution to TraderTraitor.

We assess @binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack.