TRM Labs says it has high confidence that North Korea’s TraderTraitor group is behind a reported $6.3 billion Binance hack, while on-chain investigator ZachXBT found stolen funds from the Binance and Bitget incidents converging at one address.
Disclaimer: News content is based on public news sources and provided for information only. It does not constitute investment advice.
TRM Labs said it has high confidence in attributing the reported $6.3 billion Binance hack to TraderTraitor, a designation used for a North Korea-linked cyber threat cluster. The attribution was reported by Cointelegraph on Oct. 30, 2026, alongside the scale of the alleged Binance incident. Such a finding matters because it frames the breach as a state-linked operation rather than an ordinary criminal theft, which can change how governments, exchanges and sanctions authorities respond. TRM's confidence level is the firm's own assessment, not a court ruling or a formal government indictment.
Separately, on-chain investigator ZachXBT identified stolen funds from the Binance and Bitget hacks converging at the same address, according to the report. That observation links two separate exchange incidents through a shared destination, a pattern that can point to common control or a common laundering route. Blockchain tracing does not by itself establish who controls an address, so the convergence is best treated as an investigative lead that can be corroborated with exchange records and other data. It also gives investigators a pivot point for clustering wallets connected to both incidents.
TraderTraitor is one of several names used by security researchers and governments for North Korea-linked hacking activity, which has repeatedly been associated with cryptocurrency theft and sanctions evasion. The grouping is often discussed alongside the Lazarus Group, another North Korea-linked label used in public threat reporting. Crypto exchanges are attractive targets because stolen assets can move quickly across borders and be laundered through multiple services. As a result, attribution to a state-linked cluster typically triggers coordination among exchanges, blockchain analytics firms and law enforcement.
The cross-exchange dimension is significant because Binance and Bitget are centralized platforms with their own compliance and tracing records. If the same address received funds from both incidents, investigators can compare withdrawal logs, deposit histories and customer data to test whether the flows are connected. Exchanges may also freeze or flag related wallets, while analytics firms update risk labels that other platforms use. Those steps affect the movement of funds, even though they do not guarantee recovery.
TraderTraitor is a name used by cybersecurity researchers and governments for a North Korea-linked hacking cluster associated with cryptocurrency theft and cyber operations. It is often discussed alongside the Lazarus Group, another label used in public threat reporting on North Korea-linked activity. The designation helps investigators connect incidents that may share tools, infrastructure or laundering methods.
TRM Labs said it has high confidence in attributing the reported $6.3 billion Binance hack to TraderTraitor. That assessment is a private-sector attribution rather than a formal legal finding. It is significant because state-linked attribution can trigger sanctions, law enforcement coordination and additional scrutiny from exchanges.
ZachXBT identified stolen funds from the Binance and Bitget hacks converging at the same address, according to the report. The finding links two separate exchange incidents through a shared destination. Such convergence can suggest common control or a common laundering route, but it requires corroboration from exchange records and further blockchain analysis.
Attribution and the $6.3B Figure
Funds Converge at One Address
How TraderTraitor Fits North Korea’s Crypto Operations
Why Cross-Exchange Tracing Matters
Open Questions and Verification
This article is rewritten from public news sources and further processed by AI. It is provided for information only and does not constitute investment advice — refer to the original source for the authoritative version.
Key details remain unconfirmed in the public summary, including the precise timeline of the Binance breach, how the funds moved and whether Binance or Bitget has issued a formal response. The $6.3 billion figure and the TraderTraitor attribution should therefore be attributed to TRM Labs, while the address convergence should be attributed to ZachXBT. Independent verification would require blockchain data, exchange confirmation or official statements. Until then, the report offers a strong investigative link rather than a complete account of the incident.
A shared address gives investigators a pivot point for clustering wallets and comparing transaction histories across two incidents. It can help exchanges and analytics firms test whether the same actors or laundering networks are involved. However, an address alone does not prove who controls the funds or establish the full path of the stolen assets.
No. Attribution and on-chain tracing are investigative steps, not proof of recovery. Funds can be moved through multiple wallets and services, and recovery typically depends on exchanges freezing assets, law enforcement action or other legal processes. The public summary does not state that any funds have been recovered.
