Funds from $6.3B Binance and $388M Bitget exploits traced to single wallet via THORChain, linked to North Korea-affiliated TraderTraitor group.
Security & Exploits ·
Funds totaling $6.3 billion from a Binance exploit and $388 million from a Bitget exploit have been traced to a single wallet via THORChain, with analysis linking the activity to TraderTraitor, a group with North Korea affiliations. The consolidation of stolen assets at one address represents a significant tracing breakthrough in connecting multiple major exchange breaches to a coordinated operation.
North Korea has emerged as a consequential state-level adversary in the crypto ecosystem, systematizing cryptocurrency theft as a revenue mechanism for its sanctioned economy. State-directed hacking units and covert IT workers operate through wallets, bridges, and decentralized exchanges to move assets across blockchains. TraderTraitor, tracked under alternate designations including Jade Sleet, operates as part of a broader constellation of DPRK-linked cyber actors believed to function under state direction.
Key questions remain unresolved: the full extent of assets still held at the linked wallet, whether recovery mechanisms exist for affected exchange users, and what additional exchange infrastructure may remain vulnerable to similar infiltration. The attribution methodology and timeline for these tracing efforts have not been detailed in available reporting.