TRM Labs ties $6.3 billion Binance hack to North Korea, Tether freezes $2.67 billion

Blockchain intelligence company TRM Labs led efforts to trace the origins of the attack. In its post-incident analysis, TRM Labs attributed the Binance hack to TraitorTrader, a North Korean state-linked hacking group, based on “indisputable” evidence collected onchain and offchain. The firm also linked the $1.5 billion Bybit hack in February 2025 to the same group. Binance detailed that attackers infiltrated company systems by impersonating recruiters to deliver malware to an engineer’s computer. The malware later exploited a compromised internal artificial intelligence tool, which was then used to access the exchange’s wallet-signing service, enabling the theft. TRM Labs, established as a leading provider of blockchain intelligence solutions, quickly mobilized forensic teams and worked closely with exchanges and law enforcement to coordinate the global response.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to CoinTurk News.