North Korean Hackers Blamed for Binance’s Record Breach as Investigators Follow the Money

Three separate groups of investigators have landed on the same suspect for the Binance breach: TraderTraitor, a unit run by the North Korean state. TRM Labs says it is highly confident, citing evidence from the blockchain and from sources outside it. Chainalysis boss Jonathan Levin agrees and estimates the loss at $6.4 billion, slightly higher than Binance’s own $6.3 billion estimate. Earlier, Blockaid chief Ido Ben-Natan had noted that the planning and technical skill on display matched known North Korean operations.

The Group’s History of Big Crypto Thefts

American authorities have connected this group to several of the largest hacks ever recorded. The best known is the Bybit theft of about $1.5 billion in February 2025. Another is the DMM Bitcoin breach in May 2024, where more than $300 million vanished and the FBI, together with Japanese investigators, named North Korean operators as responsible.

Targeting People Instead of Code

The FBI says the group prefers to trick individual workers into opening the door. In the DMM case, a fake job recruiter handed an employee of wallet firm Ginco a coding test loaded with malware. Investigators believe the access it created let the attackers alter a real transaction and redirect the money. Binance says its first findings point to a hacked engineer laptop, which would fit that approach.