The large-scale hack of the cryptocurrency exchange Binance, which resulted in the withdrawal of digital assets worth billions of dollars from its wallets, may be the work of the North Korean group TraderTraitor, linked to Lazarus Group. Analysts identified characteristic signs of operations previously carried out by hackers from the DPRK.
This is stated in a study by the American company TRM Labs, published on October 29.
Experts expressed a high level of confidence in TraderTraitor's involvement in the attack. The conclusions are based on analysis of blockchain transactions, additional intelligence data, and comparison of the attackers' actions with previous operations of North Korean hackers.
In particular, researchers found similarities with the hack of the crypto exchange Bybit in February 2025, when approximately $1.5 billion was stolen. At that time, the US Federal Bureau of Investigation linked the attack to TraderTraitor.
According to TRM Labs, preparations for the Binance hack began at least 36 hours before the main attack. The attackers conducted test operations in advance and prepared infrastructure for rapid asset withdrawal.
On the evening of October 29, cryptocurrencies with a total value of approximately $6.36 billion were moved from Binance wallets across ten blockchain networks. The majority of transactions were carried out within about 20 minutes.
Analysts believe that the attackers may have gained the ability to initiate transaction signing on behalf of exchange wallets in multiple networks simultaneously. This is indicated by the nature of the simultaneous withdrawal of assets from systems that use different authorization mechanisms.
As reported by CoinDesk, other cryptocurrency transaction researchers, including ZachXBT and representatives of the company Blockaid, also supported the theory of North Korean involvement.
At the same time, the publication's sources emphasize that the perpetrators of the attack have not yet been conclusively identified. Despite the similarity with previous Lazarus operations, certain features of the movement of stolen funds differ from the usual methods of this group.
Binance itself, in a message on October 30, stated that a preliminary internal investigation points to a possible intrusion through a compromised laptop of one of the company's DevOps engineers.
According to the exchange, this allowed the attackers to gain access to a service container and initiate unauthorized withdrawal of cryptocurrencies. At the same time, the company did not find evidence of leakage of wallet private keys.
Binance has not yet officially confirmed the involvement of TraderTraitor or Lazarus Group. The company continues the investigation together with law enforcement agencies and blockchain analytics experts.
The exchange said that together with partners it has already managed to block approximately $3 billion in assets related to the incident. Binance also promised to compensate users' losses from the SAFU insurance fund and its own funds.
As a reminder, earlier "Kurs Ukrainy" reported on suspicious transfers from Binance wallets. Later, the company confirmed a large-scale security incident and temporarily restricted cryptocurrency operations.
