TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor

Decrypt10-30 12:22

In brief TRM Labs and Chainalysis have both attributed the Binance hack to TraderTraitor, the North Korean group the FBI blamed for the $1.5 billion Bybit hack. Chainalysis said it saw Binance funds ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2679211133?lang=en_US&edition=fundamental","thumbnail":"https://img.decrypt.co/insecure/rs:fit:3840:0:0:0/plain/https://cdn.decrypt.co/wp-content/uploads/2026/02/dprk-north-korea-hacker-decrypt-style-gID_7.jpg@webp","is_english":true,"pubTime":"2026-10-30 12:22","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2679211133","market":"nz","top_or_hot":-1,"title":"TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor","media":"Decrypt","content":"<div>\n<p>In brief\nTRM Labs and Chainalysis have both attributed the Binance hack to TraderTraitor, the North Korean group the FBI blamed for the $1.5 billion Bybit hack.\nChainalysis said it saw Binance funds ...</p>\n\n<a href=\"https://decrypt.co//382224/trm-and-chainalysis-tie-6-4b-binance-hack-to-north-koreas-tradertraitor\">Source Link</a>\n\n</div>\n","source":"decrypt_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nTRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-10-30 12:22 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://decrypt.co//382224/trm-and-chainalysis-tie-6-4b-binance-hack-to-north-koreas-tradertraitor><strong>Decrypt</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>In brief\nTRM Labs and Chainalysis have both attributed the Binance hack to TraderTraitor, the North Korean group the FBI blamed for the $1.5 billion Bybit hack.\nChainalysis said it saw Binance funds ...</p>\n\n<a href=\"https://decrypt.co//382224/trm-and-chainalysis-tie-6-4b-binance-hack-to-north-koreas-tradertraitor\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"ETHT","symbol_name":"ProShares Ultra Ether ETF","start_time":0,"source_url":"https://decrypt.co//382224/trm-and-chainalysis-tie-6-4b-binance-hack-to-north-koreas-tradertraitor","article_id":"2679211133","we_media_id":null,"thumbnails":["https://img.decrypt.co/insecure/rs:fit:3840:0:0:0/plain/https://cdn.decrypt.co/wp-content/uploads/2026/02/dprk-north-korea-hacker-decrypt-style-gID_7.jpg@webp"],"rights":{"source":"decrypt_highlight","url":"https://decrypt.co//382224/trm-and-chainalysis-tie-6-4b-binance-hack-to-north-koreas-tradertraitor","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2679211133","pubTimestamp":1793334124,"columns":[],"sourceInfo":{"source_id":"decrypt_highlight","name":"Decrypt"},"weMediaInfo":null,"summary":"Three blockchain analytics firms have attributed this week's hack of Binance to North Korea, with two of the largest naming TraderTraitor, a North Korean hacking group, as responsible for what both describe as the largest crypto theft on record.\nTRM Labs said it made the attribution \"with high confidence,\" based on \"robust on and off-chain intelligence.\" It put the theft at about $6.36 billion, moved out of Binance wallets on 10 blockchains, most of it in about 20 minutes from 4:05 p.m. ET on Th...","collect":0,"end_time":0,"defaultTopTitle":"decrypt.co","property":[],"viewcount":null,"language":"en","relate_stocks":{"ETHT":"ProShares Ultra Ether ETF","ETU":"T-Rex 2X Long Ether Daily Target ETF","ETHU":"2倍以太币期货ETF-Volatility Shares","ETHV":"以太坊ETF-VanEck","ETH":"低成本以太坊ETF-Grayscale","YETH":"Roundhill Ether Covered Call Strategy ETF","ETHW":"以太坊ETF-Bitwise","ETHA":"以太坊ETF-iShares","FETH":"以太币ETF-Fidelity","EETH":"以太币期货ETF-ProShares","ETHD":"ProShares UltraShort Ether ETF","ETQ":"T-Rex 2X Inverse Ether Daily Target ETF","SETH":"1倍做空以太币期货ETF-Proshares","ESK":"REX-Osprey ETH + Staking ETF","ETHE":"最大以太坊ETF-Grayscale","EZET":"以太坊ETF-Franklin","TETH":"21Shares Ethereum ETF","QETH":"以太坊ETF-Invesco Galaxy","ETCO":"Grayscale Ethereum HIGH Income ETF"},"translate_title":"TRM 和 Chainalysis 将价值 6.4B 美元的币安黑客攻击与朝鲜 TraderTraitor 联系起来","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"QETH":0.6,"ETHT":0.6,"ESK":0.6,"ETHU":0.6,"ETHV":0.6,"ETQ":0.6,"EETH":0.6,"FETH":0.6,"ETHD":0.6,"TETH":0.6,"ETH":0.6,"ETU":0.6,"ETCO":0.6,"ETHW":0.6,"ETHA":0.6,"ETHE":0.6,"EZET":0.6,"YETH":0.6,"SETH":0.6},"content_text":"In brief\nTRM Labs and Chainalysis have both attributed the Binance hack to TraderTraitor, the North Korean group the FBI blamed for the $1.5 billion Bybit hack.\nChainalysis said it saw Binance funds commingling with proceeds of last month's Bitget exploit, which had been attributed to North Korean actors.\nBinance said it has reserved more than $6.34 billion of company funds to cover losses, $5 billion of it already held in the affected tokens.\nThree blockchain analytics firms have attributed this week's hack of Binance to North Korea, with two of the largest naming TraderTraitor, a North Korean hacking group, as responsible for what both describe as the largest crypto theft on record.TRM Labs said it made the attribution \"with high confidence,\" based on \"robust on and off-chain intelligence.\" It put the theft at about $6.36 billion, moved out of Binance wallets on 10 blockchains, most of it in about 20 minutes from 4:05 p.m. ET on Thursday. That is about four times the $1.5 billion Bybit hack of February 2025, which the FBI attributed to the same group, TRM noted.Chainalysis, which put the total at about $6.4 billion, said the strongest evidence came when its investigators saw funds stolen from Binance commingling in real time with funds from last month's Bitget exploit, which had been attributed to North Korean actors.A Chainalysis spokesperson told CNN the firm had \"high confidence\" North Korea was behind the hack. Singapore-based Pangolin Intelligence also told CNN it believed a North Korean hacking unit was responsible, based on \"analyzing the on-chain activity related to this hack and correlating with information gathered from previous known incidents.\" North Korea has previously denied hacking allegations.TRM and Chainalysis both said the attacker's operational wallet was funded through Tornado Cash, a crypto mixer. TRM said that and other features, including staging that began well before the theft, matched earlier North Korea-linked attacks such as the Bybit hack and April's KelpDAO exploit.Myriad: Where does ETH go next? Click to make your prediction.How the attack workedOn Ethereum, the attacker used an EIP-7702 delegation, a feature introduced in Ethereum's Pectra upgrade that lets an ordinary wallet run smart contract code, to turn a Binance hot wallet into a sweeper it controlled, with 50 pre-signed authorizations prepared in advance, according to TRM. Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers. In TRM's assessment, that points to a compromise of Binance's hot wallet signing infrastructure.Binance has said its investigation began with a compromised engineer's laptop, but has since uncovered \"additional points of breach.\" The Bybit attack also began with a single compromised machine: North Korean hackers planted malicious code in the infrastructure of wallet provider Safe after compromising a Safe developer's computer, Decrypt reported at the time.The attacker has moved quickly to launder what it could not keep. Chainalysis said it is seeing \"never-seen-before laundering patterns,\" with thousands of transactions in a short period suggesting the use of automation to circulate funds repeatedly among addresses. The attacker also sold USDT to market makers and borrowed ETH against USDT on lending protocol Aave to race issuers' freezes, according to TRM, and now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer's reach.Tether, Circle, Ripple and World Liberty Financial have frozen about $2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB, TRM said. Binance puts the total frozen at about $3 billion.\nBinance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.\nThe company has already publicly committed to cover losses through… pic.twitter.com/UqtBd37Fpj\n— Binance (@binance) October 30, 2026In an update on Friday, Binance said it has reserved more than $6.34 billion of company funds to cover the incident, $5 billion of which is already held in the exact tokens that were stolen. It is buying the rest through market and over-the-counter channels, which \"can take longer because some tokens may have low liquidity,\" the exchange said. Those figures do not include frozen assets.\"We will weather this storm,\" Binance said.North Korean hackers have long targeted the exchange. In August 2025, Binance chief security officer Jimmy Su told Decrypt that North Korean attackers try to get hired at Binance every day, and called them the single biggest threat to crypto companies. On Wednesday, the U.S. Treasury sanctioned 10 individuals and one entity over North Korean IT worker schemes that moved millions of dollars in crypto.Daily Debrief NewsletterStart every day with the top news stories right now, plus original features, a podcast, videos and more. Email addressJoin freeJoin 72,000+ readersCreate an account to save your articles.Add on GoogleAdd Decrypt as your preferred source to see more of our stories on Google.","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.52.1","shortVersion":"4.52.1","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2679211133","isCrawlerRequest":true}