Investigation Connects North Korean TraderTraitor Group to Massive Binance Hack

Connection Between Binance Hack and North Korean Group

Cybersecurity experts have made a significant connection between a recent massive $6.3 billion hack of the Binance platform and a notorious North Korean group known as TraderTraitor. This claim is substantiated by researchers from TRM Labs, alongside on-chain investigator ZachXBT, who noted that the stolen funds from Binance are mingled with assets taken during a previous exploit at Bitget, suggesting a singular actor orchestrated both attacks.

Evidence and Analysis

TRM Labs expressed a strong belief in this attribution, having utilized both on-chain and off-chain intelligence to arrive at their conclusions. They identified the same digital wallets that received funds from the shocking Binance breach, which coincides with earlier thefts linked to Bitget. ZachXBT explained that tracking these funds through THORChain revealed that they had converged at the same address, indicating the possibility of a common perpetrator.

Expert Opinions

Moreover, Chainalysis co-founder and CEO Jonathan Levin reinforced these findings, estimating that the Binance attack could be responsible for losses totaling approximately $6.4 billion. Levin pointed out the striking parallels between this incident and past activities attributed to North Korea, specifically involving the TraderTraitor group.

This assessment is supported by Blockaid CEO Ido Ben-Natan, who indicated to Cointelegraph that the intricacy and forethought evident in the attack patterns strongly resemble those typically associated with North Korean cyber operations. Additionally, U.S. law enforcement agencies, including the FBI, have previously linked TraderTraitor to several high-stakes cybercrimes, such as the dramatic $300 million theft from DMM Bitcoin in May 2024.

Social Engineering Tactics

Research suggests that TraderTraitor employs social engineering tactics, targeting corporate employees, as demonstrated in the DMM Bitcoin case where an alleged recruiter’s malicious coding test enabled access to sensitive functions, culminating in large financial losses. This persistent connection to major breaches places TraderTraitor at the forefront of concerns regarding North Korean involvement in international cybercrime.