Binance hack: the Bybit hackers behind the $6.3 billion heist?

Coin Encyclopedia Improve your knowledge of cryptos

It's 5:51 a.m. in Paris when ZachXBT posts its update. The on-chain investigator spotted 45 minutes earlier funds from the Binance hack and that of Bitget (388 million dollars at the end of September) arriving at the same address, 0x15104a…feb7. Both flows came out of THORChain, an exchange protocol between blockchains where no intermediary can freeze anything.

“The same actor is probably behind both incidents. »

But Bitget already had a suspect. This hack was attributed to TraderTraitor, a group linked to North Korea, recalls ZachXBT. The overlaps also lead to the exploit of Kelp DAO ($292 million in April). On the Binance side, TRM Labs did not wait for ZachXBT. The analytics firm attributes the theft to TraderTraitor with high confidence, according to CoinDesk. Blockaid speaks of tactics “consistent” with Pyongyang’s operations.

Go back to February 21, 2025. Bybit loses $1.5 billion in a single transaction, a record at the time. Five days later, the FBI published a notice naming North Korea and naming the activity “TraderTraitor,” a subgroup that several researchers link to Lazarus.

No private key was leaked in these three cases, by the platforms’ own admission. Hackers enter through a human or vendor, then let the infrastructure sign for them. THORChain also comes back every time. Ben Zhou, boss of Bybit, estimated that 72% of the loot had passed through there as of March 4, 2025, and around 269 million dollars from Bitget passed there according to BlockSec.

Be careful though. A common address does not prove that the same fingers typed the commands. In September, BlockSec estimated that the overlaps around Bitget pointed “more directly to shared laundering networks than to the same attackers”. ZachXBT himself had exposed Chinese money launderers seeking help on Discord and Telegram servers on behalf of the suspected hackers.

But the TRM allocation, the modus operandi and this common portfolio all point to the same North Korean group. Only an opinion from the FBI would constitute an official verdict. The one on Bybit fell in five days.

Binance already says it has frozen around $3 billion in assets, including more than 1.5 billion USDT blocked by Tether and more than 800 million USDC by Circle. Around 1.4 billion dollars in bitcoins, spread across 19 wallets, however, escape any freezing.

Machine-translated from French