Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.
Attribution evidence file Who has been blamed for the attack, by whom, and on what stated basis. Every entry is one party's statement, quoted and archived: each line links to its statement page, which holds the quote, the capture time and the hash of the stored copy. This site makes no attribution of its own, and quoting a statement here does not adopt it.
How to read this page. Parties are listed with government sources first, then analytics firms, then everyone else. The columns and lists below are assigned by keywords in each claim's one-line summary, so a claim can be placed in a column a reader would not have chosen, and can appear in more than one. An empty cell means no approved claim was matched to it by those keywords. It does not mean the party has no such basis, and a basis stated in words the keywords miss would not show here.
Group names (and the aliases one party gives them) are the names used by the party that stated them. Where sources use the names differently, that is shown under disagreements.
75 approved statements read, from 20 parties; 15 statements about earlier incidents; 0 flagged conflicts.
At a glance Claim numbers by party and role (each links to the quoted statement further down) Party Attributes Stated basis Caveats, doubts or no attribution Says the basis is not public Federal Bureau of Investigation (FBI) 4 , 72 , 185 none matched none matched none matched Elliptic 785 , 787 306 , 540 , 785 , 786 540 none matched Hacken 15 , 29 , 30 , 157 32 32 , 912 911 Halborn 777 , 778 774 , 776 , 777 , 778 , 779 777 774 TRM Labs 45 , 151 , 224 , 302 48 , 151 , 539 none matched none matched Chainalysis 190 , 193 297 none matched none matched Richard Teng none matched none matched 34 , 346 none matched ZachXBT 784 128 , 347 , 783 none matched none matched Jonathan Levin 49 , 127 , 782 none matched none matched none matched The Next Web none matched 788 789 none matched Tom Robinson 377 none matched none matched none matched BBC News none matched none matched none matched none matched Binance none matched none matched none matched none matched Cointelegraph none matched none matched none matched none matched Donald Trump 217 none matched none matched none matched Ido Ben-Natan 515 515 none matched none matched Miguel Morel none matched none matched 514 none matched The Guardian none matched none matched none matched none matched WIRED none matched none matched 333 none matched Yahoo Finance 216 216 none matched none matched
When each attribution was published Approved timeline rows in the attribution category. The times come from different clocks and different kinds of source (a post, a blog entry, a notice that gives only a date), and they are not reconciled here.
2026-10-30 04:14 UTC
2026-10-30 04:30 UTC
2026-10-30 04:51 UTC
2026-10-30 05:00-05:59 UTC (hour precision)
2026-10-31 (date only)
Basis not public, or not recorded Two lists. The first is statements in which a source itself says the basis for an attribution is not public. The second is parties whose attribution statements are recorded here with no claim matched as a stated basis.
Sources saying the basis is not public Attribution statements with no claim matched as a basis Caveats and doubts from the sources Statements, attributed to whoever made them, that qualify an attribution or say none has been made. They are listed as stated and are not weighed against the attributions.
Reported Elliptic cautioned that the onchain overlap with the Bitget incident involved only a small portion of the Binance funds and did not conclusively establish that the same attackers were responsible. Elliptic Reported The page states that the overlap with Bitget is small, with about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that the thief left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron. Hacken Reported Hacken wrote that no government had confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days. Hacken Reported Halborn said Elliptic also lists caveats: the shared address could be a launderer serving several clients, the stablecoins were held longer than North Korea usually holds them, the cash-out used market makers and lending rather than bridges, and no government had spoken whereas the FBI attributed Bybit within five days. Halborn Reported Teng said the investigation has not attributed responsibility to any individual, and Binance says it is working with law enforcement to confirm who is behind it. Richard Teng Reported Cointelegraph reported that the speaker wrote that Binance's investigation has not attributed responsibility to any individual. Richard Teng Reported The Next Web reported that Binance has not named a culprit and that North Korea has denied involvement in hacks in the past. The Next Web Reported Arkham CEO Miguel Morel stated that there was insufficient information to determine whether the attack involved stolen keys or compromised infrastructure and that the hack appeared to be still ongoing. Miguel Morel Reported WIRED reported, before the FBI statement, that neither Binance nor law enforcement officials had named suspected links to North Korean hackers. WIRED Public commentary, labelled as theory 2 labelled statements Comments from public forums, recorded with status theory. They are opinions, not evidence, and are not counted as any party's position.
Earlier incidents named in the sources Two things are kept apart. First, notices and firm reports about earlier incidents, quoted from their own pages and dated before this incident. Second, statements about this incident that compare it with earlier ones. A comparison is the source's own, and similarity is not shown here as proof.
Notices and reports about earlier incidents Internet Crime Complaint Center (IC3) | North Korea Responsible for $1.5 Billion Bybit Hack (FBI IC3) Open the original page
FBI, DC3, and NPA Identification of North Korean Cyber Actors, Tracked as TraderTraitor, Responsible for Theft of $308 Million USD from Bitcoin.DMM.com — FBI (FBI) Open the original page
Official The FBI, the Department of Defense Cyber Crime Center and Japan's National Police Agency said on 23 December 2024 that the May 2024 theft of $308 million from DMM was by North Korean cyber actors and is affiliated with TraderTraitor threat activity. Federal Bureau of Investigation (FBI), FBI. Original Statement 794 Captured 2026-11-01 14:48 UTC . Official The FBI, DC3 and Japan's National Police Agency said in their DMM notice that TraderTraitor activity is often characterized by targeted social engineering directed at multiple employees of the same company simultaneously. Federal Bureau of Investigation (FBI), FBI. Original Statement 795 Captured 2026-11-01 14:48 UTC . Official The FBI, DC3 and Japan's National Police Agency said a North Korean cyber actor posing as a LinkedIn recruiter contacted an employee of Ginco, a Japan-based wallet software company, in late March 2024. Federal Bureau of Investigation (FBI), FBI. Original Statement 796 Captured 2026-11-01 14:48 UTC . Official The FBI said that after mid-May 2024 TraderTraitor actors exploited session cookie information to impersonate the compromised employee. Federal Bureau of Investigation (FBI), FBI. Original Statement 797 Captured 2026-11-01 14:48 UTC . Official The FBI, DC3 and Japan's National Police Agency said the actors likely used their access in late May 2024 to manipulate a legitimate transaction request by a DMM employee, resulting in the loss of 4,502.9 BTC worth $308 million at the time. Federal Bureau of Investigation (FBI), FBI. Original Statement 798 Captured 2026-11-01 14:48 UTC . The largest theft in history - following the money trail from the Bybit Hack | Elliptic (Elliptic) Open the original page
Statements comparing this incident with earlier ones Reported TRM Labs and Chainalysis noted that the heist bore similarities to previous large attacks blamed on North Korea. Yahoo Finance Reported Jonathan Levin of Chainalysis posted on X that Chainalysis assessed the hack as likely done by the DPRK group TraderTraitor due to links to a previous hack. Jonathan Levin, X Reported ZachXBT posted on X that funds stolen from Binance and from the Bitget exploit were commingled at the same address 45 minutes before his post, after arriving via THORChain, which he said indicates the same actor is likely behind both incidents. ZachXBT, X Reported ZachXBT's post says the Bitget exploit was attributed to DPRK-linked; the archived text of the post ends at that word. ZachXBT, X Reported Cointelegraph reported that onchain investigator ZachXBT said stolen funds from the Binance attack and the earlier Bitget exploit were commingled in the same address after arriving via THORChain. ZachXBT, Cointelegraph Reported Chainalysis said its strongest evidence for TraderTraitor was seeing Binance funds commingle in real time with funds stolen in the Bitget exploit. Chainalysis, Chainalysis Reported Elliptic said funds stolen from Binance and from the Bitget exploit have been combined in several wallets, and that the link was first reported by ZachXBT. Elliptic, Elliptic Reported Elliptic said it identified common service usage between those laundering the Binance funds and those behind three earlier thefts attributed to TraderTraitor, from BigONE, WOO X and AFX. Elliptic, Elliptic Reported Elliptic said the long preparation, the apparent targeting of staff and the use of Binance's own systems to sign transactions resemble earlier TraderTraitor thefts, including Bybit. Elliptic, Elliptic Reported Elliptic said the FBI has previously attributed the Bybit and DMM Bitcoin thefts to TraderTraitor. Elliptic, Elliptic Reported TRM stated that several features of the attack match earlier North Korea-linked heists, including the Bybit hack. TRM Labs, npr.org Reported The page notes that stolen Binance funds were seen mixing in real time with funds from the Bitget theft, which had been attributed to North Korean actors, and that funds from both thefts reached the same Ethereum address as first reported by ZachXBT. Hacken Reported The page states that the overlap with Bitget is small, with about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that the thief left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron. Hacken Reported Hacken wrote that no government had confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days. Hacken Reported TRM cited similarities to previous North Korean operations, including Tornado Cash funding, advance staging, and pre-signed authorizations. TRM Labs, The Block Reported Elliptic cautioned that the onchain overlap with the Bitget incident involved only a small portion of the Binance funds and did not conclusively establish that the same attackers were responsible. Elliptic, The Block Reported Halborn said Elliptic rates the attribution as likely and lists a laundering address shared with the September Bitget theft, with only about 39,000 dollars of Binance funds against 510,000 linked to Bitget. Halborn Reported Halborn said Elliptic's further reasons were the preparation pattern seen in Bybit and KelpDAO, the targeting of staff matching the DMM Bitcoin case, and the capability to drain eleven chains in three hours. Halborn Reported Halborn said Elliptic also lists caveats: the shared address could be a launderer serving several clients, the stablecoins were held longer than North Korea usually holds them, the cash-out used market makers and lending rather than bridges, and no government had spoken whereas the FBI attributed Bybit within five days. Halborn Reported Halborn said Sygnia traced the Bybit loss to a compromised developer workstation, stolen cloud session tokens and a tampered signing interface, called it the same playbook with a different entry, and added that precedent is not evidence. Halborn Disagreements No flagged conflict touches attribution yet.
A pair appears once a person has reviewed it and both statements are approved claims.
Theories about attribution Theory Open
Some firms and commenters raised doubts about attributing the theft to North Korea's TraderTraitor group. Before the FBI statement, Hacken wrote "None of this is proof" and pointed to what it calls "the most careful reading", an Elliptic analysis it links, as explaining why. The passage lists a small overlap with funds from the Bitget theft and a slower pace of conversion than it said North Korean groups usually show. On Hacker News, two commenters suggested North Korea was a convenient or politically attractive target to blame.
Assessment on the theory page: On 31 October the FBI said North Korea was responsible and named TraderTraitor. TRM Labs, Chainalysis and Elliptic reached the same view earlier. They cite the on-chain link to Bitget funds, the preparation, and methods similar to the Bybit theft. The reasons for caution in Hacken's text, which credits an Elliptic analysis it links as the most careful reading, were written before the FBI statement. The FBI statement we captured does not set out its evidence. In the sources captured as of 2026-11-01, the two Hacker News comments give no evidence for another actor. In the sources captured as of 2026-11-01, Binance has not published its root cause. Hacken wrote that "that firm", the Elliptic analysis it links, calls this "the most diagnostic fact still missing". As of 2026-11-01 the weight of captured public attribution points to North Korea, with technical questions still open.
15 quoted items of evidence Context. The BBC described TraderTraitor as also known as the Lazarus Group. BBC News. Original Statement 338 Captured 2026-11-01 12:47 UTC . Note: BBC says TraderTraitor is also known as Lazarus.
Evidence for. The page states that the overlap with Bitget is small, with about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that the thief left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron. Hacken. Original Statement 32 Captured 2026-11-01 12:47 UTC . Note: Hacken, pointing to what it calls "the most careful reading" (an Elliptic analysis it links): the overlap with Bitget funds is small, and the thief converted the stolen USDT more slowly than North Korean groups usually do.
Evidence for. Hacken wrote that the root cause is still unpublished, which, it wrote, "that firm" calls "the most diagnostic fact still missing". The passage follows Hacken's link to an Elliptic analysis, which it calls "the most careful reading". Hacken. Original Statement 911 Captured 2026-11-01 12:47 UTC . Note: Hacken: root cause still unpublished. Hacken's text gives "the most diagnostic fact still missing" to the Elliptic analysis it links.
Context. Hacken wrote that no government had confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days. Hacken. Original Statement 912 Captured 2026-11-01 12:47 UTC . Note: Written before the FBI statement.
Evidence against. Elliptic said very few actors could coordinate an attack across 11 blockchains in around three hours. Elliptic, Elliptic. Original Statement 306 Captured 2026-11-01 12:47 UTC . Note: Elliptic: few actors could coordinate this.
Evidence against. Elliptic said the Binance theft closely resembles the Bybit theft, in which a developer's machine at the wallet provider Safe{Wallet} was compromised. Elliptic, Elliptic. Original Statement 307 Captured 2026-11-01 12:47 UTC . Note: Elliptic: resembles Bybit.
Evidence against. Elliptic said funds stolen from Binance and from the Bitget exploit have been combined in several wallets, and that the link was first reported by ZachXBT. Elliptic, Elliptic. Original Statement 310 Captured 2026-11-01 12:47 UTC . Note: Elliptic: Binance and Bitget funds combined in several wallets.
Context. WIRED reported, before the FBI statement, that neither Binance nor law enforcement officials had named suspected links to North Korean hackers. WIRED. Original Statement 333 Captured 2026-11-01 12:48 UTC . Note: WIRED, before the FBI statement.
Context. The Guardian live blog described TraderTraitor as having emerged from Lazarus, a group working from North Korea's Reconnaissance General Bureau. The Guardian. Original Statement 402 Captured 2026-11-01 12:48 UTC . Note: The Guardian says TraderTraitor emerged from Lazarus.
Evidence against. TRM Labs attributed the attack to TraderTraitor, which it called North Korea's elite hacking unit, with high confidence. TRM Labs, TRM Labs. Original Statement 302 Captured 2026-11-01 12:48 UTC . Note: TRM attributes to TraderTraitor with high confidence.
Evidence against. Cointelegraph reported that the speaker said this indicates the same actor is likely behind both incidents. ZachXBT, Cointelegraph. Original Statement 347 Captured 2026-11-01 12:52 UTC . Note: ZachXBT says the same actor is likely behind both.
Evidence against. Chainalysis said its strongest evidence for TraderTraitor was seeing Binance funds commingle in real time with funds stolen in the Bitget exploit. Chainalysis, Chainalysis. Original Statement 297 Captured 2026-11-01 13:11 UTC . Note: Chainalysis: funds commingled with Bitget funds.
Evidence against. The FBI said in an alert dated October 31, 2026 that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026, and that it refers to this North Korean activity as TraderTraitor. Federal Bureau of Investigation (FBI), FBI. Original Statement 185 Captured 2026-11-01 13:11 UTC . Note: FBI says North Korea was responsible.
Evidence for. A Hacker News commenter commented that North Korea is a convenient target to blame instead of highlighting random insiders as the actual cause. Hacker News. Original Statement 423 Captured 2026-11-01 13:39 UTC . Note: Commenter says North Korea is a convenient target.
Evidence for. A Hacker News commenter commented that picking politically attractive proxy scapegoats is a classic move. Hacker News. Original Statement 429 Captured 2026-11-01 13:39 UTC . Note: Commenter says scapegoats are a classic move.
Theory Unsupported
No source captured as of 2026-11-01 reports evidence that an insider was involved, and no investigator or official in those sources has said so. Some Hacker News commenters asked whether the theft was an inside job, and one wrote that it was almost certainly an inside job given the knowledge of Binance systems the attack needed. This is speculation by commenters.
Assessment on the theory page: Commenters point to the knowledge of Binance systems the attack needed. Binance's co-CEO said the investigation has not attributed responsibility to any individual. The FBI says North Korea's TraderTraitor group is responsible. We found no source, in the sources captured as of 2026-11-01, that reports evidence of knowing insider involvement. In the sources captured as of 2026-11-01, Binance has not yet published its post-mortem, so how the attacker obtained the signatures is not public. We do not identify or comment on any individual.
8 quoted items of evidence Context. Hacken said nobody outside Binance knows whether a policy layer was set on the signing system, what it checked, or how the attacker obtained signatures. Hacken. Original Statement 316 Captured 2026-11-01 12:47 UTC . Note: How signatures were obtained is not public. (in the sources captured as of 2026-11-01)
Context. Elliptic reported that Richard Teng said in a video update that the attack was not carried out by one person. Elliptic, Elliptic. Original Statement 308 Captured 2026-11-01 12:47 UTC . Note: Teng said the attack was not carried out by one person.
Context. TRM Labs said preparation began at least 36 hours before the theft, with the operator wallet receiving three small Tornado Cash withdrawals from the morning of 28 October. TRM Labs, TRM Labs. Original Statement 301 Captured 2026-11-01 12:48 UTC . Note: Preparation traced on-chain, including test runs.
Context. Cointelegraph reported that the speaker wrote that Binance's investigation has not attributed responsibility to any individual. Richard Teng, Cointelegraph. Original Statement 346 Captured 2026-11-01 12:52 UTC . Note: Binance has not attributed responsibility to any individual. (in the sources captured as of 2026-11-01)
Evidence against. The FBI said in an alert dated October 31, 2026 that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026, and that it refers to this North Korean activity as TraderTraitor. Federal Bureau of Investigation (FBI), FBI. Original Statement 185 Captured 2026-11-01 13:11 UTC . Note: The FBI attributes the theft to North Korea.
Context. A Hacker News commenter commented that the hack was almost certainly an inside job given the knowledge of Binance systems required. Hacker News. Original Statement 375 Captured 2026-11-01 13:33 UTC . Note: Commenter's view, no evidence given. (in the sources captured as of 2026-11-01)
Context. A Hacker News commenter wrote that a risk management system should not let $5bn be transferred instantly, and wondered whether it was an inside job. Hacker News. Original Statement 473 Captured 2026-11-01 13:39 UTC . Note: Asks about an inside job after noting the size of the transfers.
Context. A Hacker News commenter asked whether there was actually a hack into Binance systems or just an insider or credential leak. Hacker News. Original Statement 424 Captured 2026-11-01 13:39 UTC . Note: A question, not an assertion.
Not yet answered 7 approved statements in this record.
Statements by Federal Bureau of Investigation (FBI) Reported attribution The FBI stated that North Korea was responsible for the attack. Federal Bureau of Investigation (FBI), BBC News. Original Statement 4 Captured 2026-11-01 12:47 UTC . Reported attribution The FBI stated that it observed hackers converting stolen assets into Ethereum and expected further conversion using decentralised finance and instant swap services. Federal Bureau of Investigation (FBI), BBC News. Original Statement 5 Captured 2026-11-01 12:47 UTC . Reported attribution The FBI attributed the theft to TraderTraitor, a North Korean state-sponsored hacking group, on October 31. Federal Bureau of Investigation (FBI), Elliptic. Original Statement 72 Captured 2026-11-01 12:47 UTC . Official attribution The FBI said in an alert dated October 31, 2026 that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026, and that it refers to this North Korean activity as TraderTraitor. Federal Bureau of Investigation (FBI), FBI. Original Statement 185 Captured 2026-11-01 13:11 UTC . Official attribution The FBI said in its alert that, together with the USSS and IRS-CI, it had observed TraderTraitor actors converting stolen assets primarily into Ethereum, and expected them to be laundered further through DeFi and instant swap services. Federal Bureau of Investigation (FBI), FBI. Original Statement 186 Captured 2026-11-01 13:11 UTC . Official attribution The FBI said in its alert that it, the USSS and IRS-CI urge private sector entities to block transactions with or derived from the addresses TraderTraitor actors are using to launder the stolen assets. Federal Bureau of Investigation (FBI), FBI. Original Statement 187 Captured 2026-11-01 13:11 UTC . Official attribution The FBI said in its alert that the addresses it lists (ETH, BTC and SOL) are holding or have held assets from the theft and are operated by or closely connected to North Korean TraderTraitor actors. Federal Bureau of Investigation (FBI), FBI. Original Statement 188 Captured 2026-11-01 13:11 UTC . 7 approved statements in this record.
Statements by Elliptic Reported attribution Elliptic said it publishes a free CSV of every address its investigators have linked to the Binance hack. Elliptic, Elliptic. Original Statement 200 Captured 2026-11-01 13:11 UTC . Reported attribution Elliptic said very few actors could coordinate an attack across 11 blockchains in around three hours. Elliptic, Elliptic. Original Statement 306 Captured 2026-11-01 12:47 UTC . Reported attribution Elliptic said funds stolen from Binance and from the Bitget exploit have been combined in several wallets, and that the link was first reported by ZachXBT. Elliptic, Elliptic. Original Statement 310 Captured 2026-11-01 12:47 UTC . Reported attribution Elliptic cautioned that the onchain overlap with the Bitget incident involved only a small portion of the Binance funds and did not conclusively establish that the same attackers were responsible. Elliptic, The Block. Original Statement 540 Captured 2026-11-01 13:01 UTC . Reported attribution Elliptic said it identified common service usage between those laundering the Binance funds and those behind three earlier thefts attributed to TraderTraitor, from BigONE, WOO X and AFX. Elliptic, Elliptic. Original Statement 785 Captured 2026-11-01 12:47 UTC . Reported attribution Elliptic said the long preparation, the apparent targeting of staff and the use of Binance's own systems to sign transactions resemble earlier TraderTraitor thefts, including Bybit. Elliptic, Elliptic. Original Statement 786 Captured 2026-11-01 12:47 UTC . Reported attribution Elliptic said the FBI has previously attributed the Bybit and DMM Bitcoin thefts to TraderTraitor. Elliptic, Elliptic. Original Statement 787 Captured 2026-11-01 12:47 UTC . Hacken 7 approved statements in this record.
Statements by Hacken Reported attribution Three analytics firms linked the attack to North Korean state actors. Hacken. Original Statement 15 Captured 2026-11-01 12:47 UTC . Reported attribution The page reports that two analytics firms attribute the theft to TraderTraitor, a North Korean hacking unit, and a third firm calls it likely. Hacken. Original Statement 29 Captured 2026-11-01 12:47 UTC . Reported attribution The page notes that stolen Binance funds were seen mixing in real time with funds from the Bitget theft, which had been attributed to North Korean actors, and that funds from both thefts reached the same Ethereum address as first reported by ZachXBT. Hacken. Original Statement 30 Captured 2026-11-01 12:47 UTC . Reported attribution The page states that the overlap with Bitget is small, with about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that the thief left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron. Hacken. Original Statement 32 Captured 2026-11-01 12:47 UTC . Reported attribution Hacken's timeline table lists the first public attribution to TraderTraitor at 04:30 UTC on October 30, citing The Next Web. Hacken. Original Statement 157 Captured 2026-11-01 12:47 UTC . Reported attribution Hacken wrote that the root cause is still unpublished, which, it wrote, "that firm" calls "the most diagnostic fact still missing". The passage follows Hacken's link to an Elliptic analysis, which it calls "the most careful reading". Hacken. Original Statement 911 Captured 2026-11-01 12:47 UTC . Reported attribution Hacken wrote that no government had confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days. Hacken. Original Statement 912 Captured 2026-11-01 12:47 UTC . Halborn 6 approved statements in this record.
Statements by Halborn Reported attribution Halborn said TRM states high confidence that this is TraderTraitor, on the basis of on-chain and off-chain intelligence TRM has not published. Halborn. Original Statement 774 Captured 2026-11-01 14:21 UTC . Reported attribution Halborn said Elliptic rates the attribution as likely and lists a laundering address shared with the September Bitget theft, with only about 39,000 dollars of Binance funds against 510,000 linked to Bitget. Halborn. Original Statement 775 Captured 2026-11-01 14:21 UTC . Reported attribution Halborn said Elliptic's further reasons were the preparation pattern seen in Bybit and KelpDAO, the targeting of staff matching the DMM Bitcoin case, and the capability to drain eleven chains in three hours. Halborn. Original Statement 776 Captured 2026-11-01 14:21 UTC . Reported attribution Halborn said Elliptic also lists caveats: the shared address could be a launderer serving several clients, the stablecoins were held longer than North Korea usually holds them, the cash-out used market makers and lending rather than bridges, and no government had spoken whereas the FBI attributed Bybit within five days. Halborn. Original Statement 777 Captured 2026-11-01 14:21 UTC . Reported attribution Halborn gave its own view, before any government attribution, that the pattern fits TraderTraitor and that compliance teams should act on it rather than wait for a press release. Halborn. Original Statement 778 Captured 2026-11-01 14:21 UTC . Reported attribution Halborn said Sygnia traced the Bybit loss to a compromised developer workstation, stolen cloud session tokens and a tampered signing interface, called it the same playbook with a different entry, and added that precedent is not evidence. Halborn. Original Statement 779 Captured 2026-11-01 14:21 UTC . 6 approved statements in this record.
Statements by TRM Labs Reported attribution TRM attributed the attack to TraderTraitor, which it described as North Korea's elite hacking unit, with high confidence. TRM Labs, npr.org. Original Statement 45 Captured 2026-11-01 12:47 UTC . Reported attribution TRM stated that several features of the attack match earlier North Korea-linked heists, including the Bybit hack. TRM Labs, npr.org. Original Statement 48 Captured 2026-11-01 12:47 UTC . Reported attribution TRM said it attributes the attack to TraderTraitor, which it calls North Korea's premier hacking unit, based on on-chain and off-chain intelligence sources. TRM Labs, TRM Labs. Original Statement 151 Captured 2026-11-01 12:48 UTC . Reported attribution Experts such as TRM Labs attributed the $6.3bn Binance cryptocurrency theft to the North Korean hacking unit TraderTraitor, also known as the Lazarus Group. TRM Labs, The Guardian. Original Statement 224 Captured 2026-11-01 12:48 UTC . Reported attribution TRM Labs attributed the attack to TraderTraitor, which it called North Korea's elite hacking unit, with high confidence. TRM Labs, TRM Labs. Original Statement 302 Captured 2026-11-01 12:48 UTC . Reported attribution TRM cited similarities to previous North Korean operations, including Tornado Cash funding, advance staging, and pre-signed authorizations. TRM Labs, The Block. Original Statement 539 Captured 2026-11-01 13:01 UTC . 3 approved statements in this record.
Statements by Chainalysis 2 approved statements in this record.
Statements by Richard Teng 4 approved statements in this record.
Statements by ZachXBT 3 approved statements in this record.
Statements by Jonathan Levin The Next Web 2 approved statements in this record.
Statements by The Next Web 2 approved statements in this record.
Statements by Tom Robinson BBC News 1 approved statement in this record.
Statements by BBC News 1 approved statement in this record.
Statements by Binance Cointelegraph 1 approved statement in this record.
Statements by Cointelegraph 1 approved statement in this record.
Statements by Donald Trump 1 approved statement in this record.
Statements by Ido Ben-Natan 1 approved statement in this record.
Statements by Miguel Morel The Guardian 1 approved statement in this record.
Statements by The Guardian WIRED 1 approved statement in this record.
Statements by WIRED Yahoo Finance 1 approved statement in this record.
Statements by Yahoo Finance