TRM Labs and ZachXBT trace stolen funds from Binance and Bitget to shared addresses

Recent intelligence from blockchain intelligence firm TRM Labs has linked the notorious North Korean hacking collective known as TraderTraitor to a massive $6.3 billion security breach affecting major cryptocurrency exchange Binance. According to the investigation, analysts hold high confidence in this state sponsored attribution, pointing to sophisticated laundering patterns and infrastructure overlaps that match previous campaigns associated with the group.

This new disclosure arrives alongside independent findings from on chain investigator ZachXBT, who identified that stolen assets originating from both the Binance exploit and a separate incident involving Bitget are actively converging at the exact same deposit addresses. The convergence of these illicit funds highlights a coordinated cash out operation, suggesting that distinct exploits targeting the digital asset ecosystem may ultimately feed into the same centralized laundering networks.

For the broader cryptocurrency market, these findings underscore the persistent and evolving threat posed by state backed cyber syndicates. As decentralized finance and centralized exchanges continue to handle trillions in transaction volume, the ability of groups like TraderTraitor to siphon and obscure billions in digital assets remains a critical vulnerability that demands heightened vigilance and stronger cross platform cooperation.

Industry reactions have focused heavily on the operational security measures required to counter such advanced threats. Security experts and compliance officers have emphasized that tracing cross chain movements in real time is no longer optional for exchanges, especially as North Korean actors continually refine their techniques to bypass standard know your customer and anti money laundering protocols.

As investigators continue to map out the infrastructure used in these attacks, attention is turning toward how exchanges and law enforcement agencies can disrupt these laundering pipelines before funds are successfully converted into fiat currency. Enhanced information sharing across the sector will likely play a pivotal role in freezing illicit deposits and holding perpetrators accountable in the coming months.