TRM Labs Attributes Binance Attack to North Korean Group TraderTraitor

TRM Labs assessed with high confidence that TraderTraitor carried out the attack on Binance, identifying a North Korean hacking group as the suspected actor in the exchange security incident.

The blockchain intelligence firm said its conclusion drew on both on-chain and off-chain intelligence. The assessment names TraderTraitor as the suspected group behind the attack and describes it as an elite North Korean hacking organization affiliated with Lazarus Group.

TRM also identifies TraderTraitor as part of Lazarus Group, linking the alleged attacker to a wider hacking organization. The attribution has two parts: the name of the group TRM believes executed the Binance attack and the larger organization to which the firm connects it.

The assessment is security news for crypto markets because it identifies an alleged perpetrator and states the intelligence basis TRM used. The firm characterized its conclusion as high confidence and grounded in analysis of on-chain and off-chain intelligence.