TRM Assesses Lazarus Group Behind Binance’s $6.3 Billion Theft

TRM Labs assessed with high confidence that TraderTraitor, a unit of North Korea’s Lazarus Group, carried out Binance’s reported $6.3 billion theft, though officials have not confirmed the attribution.

Assets from Binance wallets on 10 blockchains began moving to one attacker at 4:05 p.m. ET Oct. 29 (20:05 UTC). By 10:23 p.m. ET (02:23 UTC Oct. 30), Binance’s preliminary investigation pointed to a DevOps engineer’s laptop as a likely entry point for unauthorized withdrawals. Binance said about $3 billion had been frozen on-chain and its SAFU fund and company resources would cover the full loss.

TRM based its assessment on similarities to the February 2025 Bybit attack and April 2026 Kelp DAO incident. It cited small operational-wallet deposits from Tornado Cash, preparations well before the theft and signatures gathered in advance for a batch of transactions. TRM said preparations began at least 36 hours before the attack, and the same code was installed on Binance’s hot wallet four hours after a rehearsal.

ZachXBT also described Lazarus as a likely suspect in an X reply. Security researcher Taylor Monahan identified North Korea and cautioned against underestimating TraderTraitor. The attribution remains unconfirmed by officials.