Blockchain intelligence company TRM Labs led efforts to trace the origins of the attack. In its post-incident analysis, TRM Labs attributed the Binance hack to TraitorTrader, a North Korean state-linked hacking group, based on “indisputable” evidence collected onchain and offchain. The firm also linked the $1.5 billion Bybit hack in February 2025 to the same group.