What happened
TRM Labs, the blockchain intelligence firm that works with U.S. and international law enforcement, said on Friday it has attributed the $6.3 billion Binance hack to North Korean threat actors with high confidence. The attribution was corroborated by independent on-chain investigator ZachXBT, who identified stolen funds from the Binance exploit and a separate Bitget breach moving into the same address, a pattern consistent with Lazarus Group laundering tradecraft. Cointelegraph reported the findings first, citing statements from both parties.
Neither Binance nor Bitget has publicly confirmed the attribution. The investigators have not published the specific wallet address in open channels, a standard practice while funds are still being traced and freeze requests are in flight. TRM has previously flagged North Korean involvement in the Ronin, Harmony, and WazirX exploits using similar clustering techniques.
Why it matters
At $6.3 billion, the Binance figure would make this the largest single exchange hack ever attributed to a nation-state actor, dwarfing the $625 million Ronin bridge drain in 2022 and the $230 million WazirX breach last year. The convergence of Binance and Bitget stolen funds at a single address is the harder claim: it suggests both exchanges were hit by the same operator cluster, not two unrelated groups.
The headline looks like a disaster for exchange trust. The flow picture tells a quieter story. Binance has not halted withdrawals and USDT redemptions on the platform remained live through Friday morning Asia hours. If Tether and Circle move to freeze flagged addresses, as they did after the Poloniex and FixedFloat incidents, meaningful recovery is possible. That is the lever worth watching, not the headline number.