Chainalysis and TRM Labs link $6.3 billion Binance hack to North Korea's TraderTraitor

What sources claim

• Chainalysis and TRM Labs linked the $6.3 billion Binance hack to North Korea's TraderTraitor group, and Chainalysis put the total at $6.4 billion in its own assessment.
• Chainalysis said the attacker swapped $325 million in stablecoins into $285 million in ETH over roughly 20 minutes, then sent the remaining $175 million to stopover wallets, with freezes beginning by 5:14 p.m. Eastern.
• Binance said its initial investigation points to a compromised engineer's laptop that gave an attacker access to a service container and enabled unauthorized withdrawals, and that it found no evidence of a wallet private key leak.

Still unresolved

• How much of the stolen assets will ultimately be recovered, given that Binance says about $3 billion has been frozen onchain in total?
• What on-chain or law-enforcement findings would confirm the TraderTraitor attribution at this scale?

Evidence levels describe source coverage, not the probability that a report is true. Price moves and their timing cannot establish a cause; minute samples show an observed interval and alert thresholds are heuristics. Explanations are model-assisted, with citations and figures checked. Source titles stay in their original language; full articles are not republished.

Measured from the sample nearest site detection, on the same source and quote currency.