Statements

Binance has not named a culprit. North Korea has denied involvement in hacks in the past

TRM said it makes its North Korea judgment “with high confidence”, based on on-chain and off-chain intelligence.

In Bybit, Sygnia traced the loss to a compromised developer workstation at the wallet provider, stolen cloud session tokens and a tampered signing interface. Same playbook, different entry. Precedent is not evidence, but it is a very good search warrant.

My view is that the pattern fits and that a compliance team should act on it today rather than wait for a press release.

Elliptic also lists the caveats: the shared address could be a launderer serving several clients, the stablecoins were held longer than North Korea usually holds them, the cash-out went through market makers and lending rather than bridges, and no government has said a word, whereas the FBI attributed Bybit within five days. Binance has named nobody.

the preparation pattern of Tornado Cash funding, rehearsal and pre-signed bursts seen in Bybit and in KelpDAO in April; the targeting of staff, which matches the DMM Bitcoin case; and the capability to drain eleven chains in three hours.

Elliptic says likely, and lists its reasons: a laundering address shared with the September Bitget theft, 0x1510…feb7, although only about 39,000 dollars of Binance funds reached it against 510,000 linked to Bitget;

On attribution, TRM states high confidence that this is TraderTraitor, the North Korean unit the FBI named for Bybit, on the basis of on-chain and off-chain intelligence it has not published.

Download every address our investigators have linked to the Binance hack as a single CSV file.

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.

The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.

they had robust intelligence pointing to North Korean state-backed hacking unit the Lazarus Group, also known as TraderTraitor

The FBI said it had observed hackers converting stolen assets into a type of cryptocurrency called Ethereum and that it is expected that the assets will then be converted again using decentralised finance and instant swap services.

The Federal Bureau of Investigation (FBI) said on Saturday that North Korea was responsible for the attack.

Yet, picking politically attractive proxy-scapegoats is a classic pro move.

I think NK is a convenient target to blame, instead of highlighting that random events from random insiders across different financial operations are the actual cause.

The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."

On October 31, the FBI attributed the theft to TraderTraitor, its name for a North Korean state-sponsored hacking group. This confirms Elliptic's earlier assessment.

Elliptic also cautioned that the onchain overlap with the Bitget incident involved only a small portion of the Binance funds and did not conclusively establish that the same attackers were responsible.

TRM cited similarities to previous North Korean operations, including Tornado Cash funding, advance staging and pre-signed authorizations.

Finally, no government has confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days .

None of this is proof, and the most careful reading explains why. The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster. The laundering through market makers and lending protocols doesn't match the older pattern either, and the root cause is still unpublished, which that firm calls "the most diagnostic fact still missing."

Binance hasn't named a culprit. Teng said the investigation has not attributed responsibility to any individual, and Binance says it is working with law enforcement to confirm who is behind it.

The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster.