Blockchain Sleuths Blame North Korea: The $6.36 Billion Binance Theft Is Four Times Bybit
This is no longer "an exchange got hacked." It's a state-level industry that has been running for years, and it just closed another very large order.
Three key facts
Three blockchain analytics firms have attributed this week's Binance hack to North Korea, with the two largest naming TraderTraitor. According to Decrypt, TRM Labs said it made the attribution "with high confidence" based on "robust on and off-chain intelligence," putting the loss at about $6.36 billion — funds moved out on 10 blockchains, most of it within about 20 minutes starting 4:05 p.m. ET Thursday.
The scale is startling: about four times the February 2025 Bybit hack ($1.5 billion) — which the FBI also attributed to this group. Chainalysis put the total at about $6.4 billion, and said its strongest evidence came from investigators watching Binance funds commingling in real time with proceeds from last month's Bitget exploit, also attributed to North Korean actors.
The tradecraft matches earlier North Korea-linked attacks. Both TRM and Chainalysis note the attacker's operational wallet was funded through the Tornado Cash mixer; TRM said that, plus staging that began well before the theft, matched the Bybit hack and April's KelpDAO incident. North Korea has consistently denied hacking allegations.
Wang Dou's Take
Note one easily missed detail first: Chainalysis's strongest evidence isn't "similar technical characteristics" — it's "the money mixed together." That distinction matters: the former is inference, the latter is evidence. When you see proceeds from two separate cases flowing to the same place at the same time on-chain, it's no longer "possibly the same origin"; it's "the same person operating." That's blockchain's most ironic trait — it hands criminals a fast-moving tool, and hands investigators a ledger that can't be erased.
Second, that 20 minutes. $6.36 billion out of 10 chains in 20 minutes isn't "hacker genius"; it's industrialized process — parallel chains, pre-staged addresses, automated scripts. And that should force an admission: against an adversary at this level, a single exchange's defense-in-depth isn't enough, because the other side's preparation timeline is measured in years.
Third, the most structurally revealing point: Bybit at $1.5 billion, Bitget, KelpDAO, and now Binance at $6.36 billion. The same crew, repeated success, growing scale. Why? Because the money can be laundered, and the cost of laundering is far below the amount stolen. As long as the "cash out" route stays open, stealing is always worth it. So the real question isn't "how high are Binance's walls" but "why is the Tornado Cash route still open at all."