Chainalysis Says TraderTraitor Likely Behind Binance Incident

Chainalysis assessed that North Korea-linked group TraderTraitor likely carried out Binance’s Oct. 29 security incident, adding a second analytics firm’s attribution to an attack Binance estimated had a total impact of $6.3 billion.

Chainalysis co-founder and CEO Jonathan Levin tied the assessment to links with a previous hack. Levin put the theft at $6.4 billion; a separate estimate valued it at $5.912 billion at the time of the theft.

TRM Labs had also attributed the attack to TraderTraitor and described its assessment as high confidence. Binance’s update at 10:23 p.m. ET Thursday (02:23 UTC Friday) estimated the incident’s total impact at about $6.3 billion and said about $3 billion had been frozen on-chain.

Binance has not named an attacker. It said its investigation remained ongoing and that it was working with law enforcement to confirm identities. The FBI attributed the Feb. 21, 2025, theft of about $1.5 billion from Bybit to North Korean actors and referred to that activity as TraderTraitor; the earlier case does not establish who carried out the Binance attack.

Binance’s latest service update said withdrawals were expected to resume within 48 hours, without a specific reopening time.