TRM Labs ties $6.3 billion Binance hack to North Korea, Tether freezes $2.67 billion

Blockchain intelligence company TRM Labs led efforts to trace the origins of the attack. In its post-incident analysis, TRM Labs attributed the Binance hack to TraitorTrader, a North Korean state-linked hacking group, based on “indisputable” evidence collected onchain and offchain. The firm also linked the $1.5 billion Bybit hack in February 2025 to the same group. Binance detailed that attackers infiltrated company systems by impersonating recruiters to deliver malware to an engineer’s computer. The malware later exploited a compromised internal artificial intelligence tool, which was then used to access the exchange’s wallet-signing service, enabling the theft.