Blockchain-intelligence firm TRM Labs said on 29 October that it attributes with "high confidence" the roughly US$6.36 billion drained from Binance from 20:05 UTC that day to TraderTraitor, the North Korean unit the FBI named in the Bybit case. On Ethereum an EIP-7702 delegation reportedly turned a hot wallet into an attacker-controlled sweeper; Binance acknowledged a "security incident", paused withdrawals on several networks and reported about US$2.5 billion frozen. Binance has published no root cause and no government has confirmed the attribution.
From developments to evidence and analysis
Background
No explicit relationship is recorded.
Evidence
No explicit relationship is recorded.
Follow-ups / later versions
No explicit relationship is recorded.
Related questions
Cite this article
AI & Security Observatory（2026-10-29）「TRM Labs、Binanceからの約63.6億ドル流出を北朝鮮によるものと判定 暗号資産史上最大の窃取」『AI & Security Observatory』、第1.0版、最終更新2026-11-01。https://ai-security-observatory.org/ja/brief/brief-20261101-08/
AI & Security Observatory (2026-10-29). TRM Labs attributes a record US$6.36 billion theft from Binance to North Korea's TraderTraitor, with about US$2.7 billion frozen . AI & Security Observatory, version 1.0. Updated 2026-11-01. https://ai-security-observatory.org/en/brief/brief-20261101-08/
Version 1.0 · Publication date 29 Oct 2026 · Updated 1 Nov 2026
Revision history
- Earlier revisions have not been recorded.