TRM Labs Attributes $6.36 Billion Binance Theft to North Korean Hackers

Blockchain intelligence company TRM Labs has attributed an estimated $6.36 billion theft from Binance to TraderTraitor, a North Korean hacking unit. In an analysis published on October 30, TRM said its on-chain and off-chain investigation linked the attack to the group. The estimate values the stolen assets at their prices when taken and covers ten blockchains. TRM said, “We make this judgment with high confidence.” It reported that most initial transfers began at 20:05 UTC on October 29, followed by another wave around 23:05 UTC that reached Avalanche and Polygon. Ethereum accounted for approximately $3.79 billion, while Bitcoin outflows totaled 18,270 BTC, worth about $1.47 billion at the time of the theft, according to its analysis. On Ethereum, TRM said the attacker used 50 pre-signed authorizations to install code that repeatedly drained an internet-connected Binance wallet. Transfers on other blockchains used ordinary signatures. TRM assessed the pattern across different networks as pointing to a compromise of Binance’s hot-wallet signing infrastructure. It also reported preparations beginning at least 36 hours before the theft, including small withdrawals from Tornado Cash and tests of the attack code. In its snapshot as of 00:30 UTC on October 30, TRM put frozen assets at roughly $2.7 billion, including approximately $2.67 billion in stablecoins. It said the attacker still held more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, which stablecoin issuers could not freeze. TRM said it was continuing to trace the funds and alert partners through its Beacon Network, and would share further findings as the investigation developed.