Key Takeaways
- TRM Labs and ZackXBT tied the Binance theft to North Korea’s Tradertraitor unit (part of the Lazarus Group) with high confidence.
- The attacker still holds over 420,000 ETH and 18,270 BTC, about $2.4 billion beyond issuer freezes.
- TRM expects the next laundering wave to move through bridges, swap services and OTC brokers.
Investigators Point to Pyongyang
The hunt for the Binance attacker has a prime suspect now, with blockchain analytics firm TRM Labs attributing the attack to Tradertraitor (part of the Lazarus ecosystem), which it called North Korea’s elite hacking unit. The firm reached that judgment with high confidence based on onchain and offchain intelligence, valuing the haul at about $6.36 billion at the time each asset was taken.
Independent investigator ZachXBT reached a similar conclusion hours earlier, and when asked who was behind the drain, he replied:
“It’s likely the Lazarus Group (DPRK)”
That said, the posts do not automatically confirm responsibility, and no government has formally named a culprit yet.
Ari Redbord, TRM’s global head of policy, told Al Jazeera the attack is unprecedented and will subsequently be looked at as a watershed moment in the history of crypto, adding:
“When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity.”
A Known Playbook but Four Times Bigger
TRM’s team believes that the staging and signature patterns match the Bybit theft from early last year, which the FBI pinned on the same group, along with the Kelpdao hack in April 2026. Blockchain analytics firm Chainalysis separately estimated about $5.912 billion was stolen, nearly four times the size of Bybit.
The preparation was methodical, with onchain researcher 0xQuit finding the attacker’s relayer was funded by three Tornade Cash withdrawals of 0.1 ETH each over the prior two days, with a delegate contract deployed at 15:59 UTC. Another analyst said the attacker rehearsed the drain six hours earlier on three fresh wallets, sweeping test amounts of multiple tokens.
The live strike came at 20:24 UTC, when 167,464 ETH moved out of the Binance 14 hot wallet. Bitcoin.com News detailed yesterday how the wallet-delegation maneuver worked as well as how Binance’s own initial findings pointed to a compromised DevOps engineer’s laptop.
Social media added a mocking twist to the entire episode, with one commentator claiming that the attacker launched a “LAZARUS” meme coin on Pump.fun. Bitcoin.com News could not verify that the deployer is linked to the hacker’s wallets.
Where the Money Is Going
Unlike Bybit, where stolen funds raced across bridges, this laundering has leaned on large trades. TRM said the attacker sold about 325 million USDT to market makers for roughly 122,300 ETH at a discount of more than 10%. It also borrowed about 19,760 ETH on Aave against 60 million USDT.
Freezes have clawed back a large share and Binance said the total amount frozen has reached approximately $3 billion. Still, TRM estimates the attacker holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond issuers’ reach, with the bitcoin moving through a peel chain, a laundering method that splits funds into a long string of smaller transfers.
Onchain Lens reported the group was moving over $1 billion in ETH to new wallets, likely ahead of mixing. TRM expects the next stage to involve cross-chain bridges, swap services, and over-the-counter (OTC) brokers.
A Record Year for Crypto Theft
The heist lands in what Defillama calls the most hacked year in crypto history, with over $8 billion stolen so far in 2026. By comparison, cybercriminals stole $2.87 billion across nearly 150 incidents in 2025.
The Binance hit also came hours after Polymarket halted trading over a separate exploit, showing how many fronts security teams are fighting on at once.
The Aftermath Could Be Unparalleled
TRM said it is alerting partners through its Beacon Network and urged exchanges to screen deposits against labeled attacker addresses. At the same time, Binance has promised a detailed technical post-mortem once its preliminary investigation is complete.
The key question now is speed, since every hour the attacker’s ETH and BTC sit unmixed gives investigators more time to flag exits, while North Korea’s track record suggests the group will try to cash out through OTC desks before the trail goes cold.
