TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor

Both firms blame the group behind the Bybit hack, as Binance says it has set aside $6.34 billion of its own funds to cover user losses.

The top 3

  1. Technical Mechanism of the Attack: The attackers utilized a multi-faceted approach, starting with a compromised engineer's laptop to gain access to service containers. On Ethereum, they leveraged the EIP-7702 delegation feature to turn a hot wallet into a sweeper using pre-signed authorizations, while performing simultaneous, rapid transfers across nine other blockchains.
  2. Evidence of Attribution to North Korea: Blockchain analytics firms TRM Labs and Chainalysis identified strong behavioral matches to known North Korean activity, including the 2025 Bybit hack. Evidence includes the commingling of stolen funds with proceeds from the previous Bitget exploit, the use of Tornado Cash to fund operational wallets, and highly specific laundering patterns.

Sources

Open the full topic