# TRM Labs and Chainalysis Link Binance Theft to TraderTraitor

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/44966
Published: 2026-10-30T17:48:24.000Z
Updated: 2026-10-30T17:48:24.000Z
Section: Technology

> About $6.36 billion in crypto moved from Binance wallets across 10 blockchains. Binance estimated the incident’s total impact at about $6.3 billion and said about $3 billion was frozen on-chain.

TRM Labs and Chainalysis linked the theft of assets from Binance to North Korea’s TraderTraitor group, though Binance has not identified an attacker and its investigation remains open.

The Oct. 29 outflow from Binance wallets totaled about $6.36 billion across 10 blockchains, using each asset’s price when it was taken. Most of the movement occurred in roughly 20 minutes beginning at 4:05 p.m. ET (20:05 UTC). The estimate covers activity through 8:30 p.m. ET (00:30 UTC Oct. 30).

Chainalysis co-founder and CEO Jonathan Levin assessed that TraderTraitor likely carried out the attack, pointing to funds from the Binance theft mixing with funds tied to a previous Bitget exploit. The assets were valued at about $5.912 billion at the time of theft, a different measure from the $6.36 billion transfer-value estimate.

Binance’s Oct. 30 update put the incident’s total impact at about $6.3 billion and said about $3 billion had been frozen on-chain. The company said it was working with law enforcement to confirm the attackers’ identities.

The FBI previously attributed the February 2025 theft of about $1.5 billion from Bybit to North Korea and used “TraderTraitor” to describe that operation.