Who are the hackers suspected in Binance's $6.3 billion crypto theft? Are they state-backed groups?

Binance hack: Hackers linked to North Korea are the main suspects in the theft of about $6.36 billion from Binance, the world’s largest crypto exchange. US blockchain analysis firm TRM Labs says the group is TraderTraitor, which it calls North Korea’s elite hacking unit. Binance has not confirmed this yet.

Who is behind the Binance hack?

TRM Labs published its findings on Thursday. It says the attacker moved about $6.36 billion out of Binance wallets across ten blockchains, most of it in around 20 minutes. If the figure holds, this is the largest crypto theft on record.

TRM says it blames TraderTraitor “with high confidence,” based on on-chain and off-chain intelligence. It also says several features of the attack match earlier North Korea-linked thefts, including the Bybit hack.


Chainalysis, another blockchain analytics firm, has a similar view. Its co-founder and CEO, Jonathan Levin, wrote on X that the hack was likely done by TraderTraitor.

Binance has not named anyone. A company spokesperson said only that it is working with law enforcement partners to confirm the identity of the criminals and bring them to justice.

Is TraderTraitor a state-backed group?

TRM describes TraderTraitor as a unit of North Korea, which would make it state-backed. No government has confirmed its role in the Binance case so far. The link comes from private security firms.

The Bybit case offers some background. In February last year, Bybit lost $1.5 billion in a hack. The FBI said North Korea and TraderTraitor were responsible.

Experts say North Korea turned to crypto theft because it needs foreign currency. Strict UN sanctions have hurt its economy, and the money is believed to help fund its nuclear programme.

In December 2022, South Korea’s spy agency said North Korean hackers had stolen around $1.1 billion in crypto and other digital assets in the previous five years, more than half of it in 2022 alone.

How the theft happened and what Binance says now

Binance first said the attacker may have got in through a compromised laptop belonging to an employee or contractor, which allowed unauthorised withdrawal requests. A later check found more “points of breach,” the company said. It also said it found no evidence that any wallet private key had leaked.

Kok Tin Gan, CEO of cybersecurity firm NyxLab, believes a single signature may have given the attacker a never-expiring, full-access token to a Binance hot wallet. A hot wallet is one connected to the internet. He questioned why stronger approval controls were not in place.

Binance says it froze roughly $3 billion of the affected assets with help from blockchain partners. Deposits were not affected. Withdrawals are suspended and should resume in a day or two.

The company says it will cover all losses and will share more technical details once its investigation ends.

Changpeng Zhao, who founded Binance, posted on X that “User funds are safe!” He said it does look like a hack, and that as a shareholder he expects all funds to be fully covered. Zhao pleaded guilty in 2023 to a felony linked to failing to prevent money laundering on the platform and stepped down as CEO. President Donald Trump pardoned him in 2025.