Blockchain analysis firm TRM Labs has attributed a cryptocurrency theft involving approximately $6.36 billion from Binance wallets to North Korea’s elite hacking unit, TraderTraitor. The assessment was reported on October 30, 2026, following an investigation that examined blockchain transactions and intelligence gathered from multiple sources.
According to TRM Labs, the attacker moved approximately $6.36 billion across ten different blockchains. The majority of the funds were transferred within approximately 20 minutes, indicating the speed at which the cryptocurrency movement took place.
The blockchain analysis firm said its attribution was based on intelligence collected from both on-chain and off-chain sources. On-chain analysis involves examining publicly recorded blockchain transactions, while off-chain intelligence can include information gathered from sources outside the blockchain network.
TRM Labs attributed the activity to TraderTraitor, a hacking unit associated with North Korea. The firm said it had reached its conclusion with a high level of confidence based on the evidence gathered during its investigation.
The reported incident highlights the challenges cryptocurrency exchanges and digital asset platforms face in monitoring transactions across multiple blockchain networks. Unlike traditional financial transactions, cryptocurrency transfers can move across different networks and wallets within a short period.
The movement of approximately $6.36 billion across ten blockchains in around 20 minutes also demonstrates the complexity involved in tracking large-scale cryptocurrency transactions.
Blockchain analysis firms such as TRM Labs examine transaction patterns and other intelligence to identify suspicious activity, trace the movement of digital assets and assess possible links between cryptocurrency transfers and known cybercrime groups.
The attribution to TraderTraitor places the incident within the wider context of cyber operations associated with North Korean hacking groups. Such groups have been linked to cryptocurrency-related cybercrime and the targeting of digital asset infrastructure.
TRM Labs’ assessment specifically identifies TraderTraitor as responsible for the reported Binance-related theft. The firm based its conclusion on its combined analysis of blockchain activity and intelligence from other sources.
The findings underline the importance of transaction monitoring, blockchain intelligence and security measures for cryptocurrency platforms operating across multiple digital asset networks.
