TRM Labs Attributes $6.36 Billion Binance Wallet Theft to North Korea’s TraderTraitor
TRM Labs reported that an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains, with most of the transfers occurring within about 20 minutes. Based on robust on-chain and off-chain intelligence, TRM Labs attributed the attack with high confidence to TraderTraitor, an elite North Korean hacking unit.
This is a valid, forward-looking cybersecurity development rather than market-performance commentary: Reuters reports that TRM Labs identified approximately $6.36 billion in transfers from Binance wallets across ten blockchains and attributed the activity with high confidence to North Korea’s TraderTraitor unit. The underlying breach and approximate loss magnitude were already reported in the related development, so this item is best treated as a high-impact attribution and scale clarification rather than a wholly new theft; importance remains very high, while surprise is lower than it would be for the initial breach. Confidence is high for the reported transfer estimate and TRM’s stated attribution, but the attribution is an analytical conclusion and the exact transfer time is unavailable. The timestamp uses the supplied Reuters timestamp as the best available proxy for when the public attribution was reported, not as the precise time of the theft. Only CRCL is approved because the context explicitly states that Circle’s USDC blacklist was used against a receiving wallet; the other proposed vendor, custody, insurance, and exchange impacts are indirect or speculative, and Binance has no exact stakeholder symbol in the input.
An attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes,
TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence.