TRM attributes the October 29 Binance theft to the North Korean state-sponsored TraderTraitor unit with high confidence, although no government had publicly attributed the incident. Investigators traced stolen proceeds through self-minted tokens and liquidity pools, lending receipt-token transfers, and chained cross-chain swaps designed to separate funding wallets from cash-out wallets. Activity was concentrated on TRON and later Solana, while the main Ethereum and Bitcoin holdings remained largely parked; nearly USD 2.7 billion of approximately USD 6.36 billion stolen had been frozen.