TRM Labs attributed the approximately $6.36 billion theft from Binance to North Korea’s TraderTraitor group with high confidence, while Binance continued working with law enforcement to identify the perpetrator. Binance’s initial investigation indicated that a compromised DevOps engineer’s laptop may have enabled access to service containers and the submission of unauthorized withdrawal transactions, with no evidence that wallet private keys were exposed. The attackers used an EIP-7702 delegation and a sweeper contract against an Ethereum hot wallet while moving additional assets through signed transactions across multiple chains. Binance reported freezing about $3 billion and said all losses would be covered through its SAFU fund and corporate resources.