Theory Open
The North Korea attribution is wrong or premature
Some firms and commenters raised doubts about attributing the theft to North Korea's TraderTraitor group. Before the FBI statement, Hacken wrote "None of this is proof" and pointed to what it calls "the most careful reading", an Elliptic analysis it links, as explaining why. The passage lists a small overlap with funds from the Bitget theft and a slower pace of conversion than it said North Korean groups usually show. On Hacker News, two commenters suggested North Korea was a convenient or politically attractive target to blame.
This is a theory, not an established fact. First seen . Updated .
What the evidence does and does not show
On 31 October the FBI said North Korea was responsible and named TraderTraitor. TRM Labs, Chainalysis and Elliptic reached the same view earlier. They cite the on-chain link to Bitget funds, the preparation, and methods similar to the Bybit theft. The reasons for caution in Hacken's text, which credits an Elliptic analysis it links as the most careful reading, were written before the FBI statement. The FBI statement we captured does not set out its evidence. In the sources captured as of 2026-11-01, the two Hacker News comments give no evidence for another actor. In the sources captured as of 2026-11-01, Binance has not published its root cause. Hacken wrote that "that firm", the Elliptic analysis it links, calls this "the most diagnostic fact still missing". As of 2026-11-01 the weight of captured public attribution points to North Korea, with technical questions still open.
Evidence
Evidence for (4)
The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster.
Hacken. Captured . Original
Note: Hacken, pointing to what it calls "the most careful reading" (an Elliptic analysis it links): the overlap with Bitget funds is small, and the thief converted the stolen USDT more slowly than North Korean groups usually do.
None of this is proof, and the most careful reading explains why. The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster. The laundering through market makers and lending protocols doesn't match the older pattern either, and the root cause is still unpublished, which that firm calls "the most diagnostic fact still missing."
Hacken. Captured . Original
Note: Hacken: root cause still unpublished. Hacken's text gives "the most diagnostic fact still missing" to the Elliptic analysis it links.
I think NK is a convenient target to blame, instead of highlighting that random events from random insiders across different financial operations are the actual cause.
Hacker News. Captured . Original
Note: Commenter says North Korea is a convenient target.
Yet, picking politically attractive proxy-scapegoats is a classic pro move.
Hacker News. Captured . Original
Note: Commenter says scapegoats are a classic move.
Evidence against (7)
Very few actors could coordinate an attack across 11 blockchains in around three hours.
Elliptic, Elliptic. Captured . Original
Note: Elliptic: few actors could coordinate this.
This closely resembles the Bybit theft, in which North Korean hackers compromised a developer's machine at the wallet provider Safe{Wallet} and manipulated the transaction that Bybit's signers approved.
Elliptic, Elliptic. Captured . Original
Note: Elliptic: resembles Bybit.
The two sets of funds have now been combined in several wallets, and the amount has grown overnight. The link was first reported by ZachXBT.
Elliptic, Elliptic. Captured . Original
Note: Elliptic: Binance and Bitget funds combined in several wallets.
North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence.
TRM Labs, TRM Labs. Captured . Original
Note: TRM attributes to TraderTraitor with high confidence.
“This indicates the same actor is likely behind both incidents,” he said.
ZachXBT, Cointelegraph. Captured . Original
Note: ZachXBT says the same actor is likely behind both.
The strongest evidence emerged when Chainalysis investigators observed, in real time, funds stolen from Binance commingling with funds stolen in last month’s Bitget exploit, which had been attributed to North Korean actors.
Chainalysis, Chainalysis. Captured . Original
Note: Chainalysis: funds commingled with Bitget funds.
The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."
Federal Bureau of Investigation (FBI), FBI. Captured . Original
Note: FBI says North Korea was responsible.
Context (4)
The BBC described TraderTraitor as also known as the Lazarus Group.
they had robust intelligence pointing to North Korean state-backed hacking unit the Lazarus Group, also known as TraderTraitor
BBC News. Captured . Original
Note: BBC says TraderTraitor is also known as Lazarus.
Finally, no government has confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days .
Hacken. Captured . Original
Note: Written before the FBI statement.
Neither Binance nor law enforcement officials have named any suspected links between the attack and North Korean hackers.
WIRED. Captured . Original
Note: WIRED, before the FBI statement.
TraderTraitor emerged from Lazarus, a group working from North Korea’s Reconnaissance General Bureau, a military intelligence agency.
The Guardian. Captured . Original
Note: The Guardian says TraderTraitor emerged from Lazarus.