TRM attributed the theft of approximately USD 6.36 billion from Binance wallets across ten blockchains to the North Korean state-sponsored group TraderTraitor with high confidence. The attacker used pre-signed EIP-7702 authorizations to delegate an Ethereum hot wallet to a sweeper contract while obtaining valid transfers from Binance wallets on nine other chains, indicating a likely compromise of cross-chain signing infrastructure. Stablecoin issuers and the Arbitrum Security Council froze roughly USD 2.7 billion, but the attacker retained more than 420,000 ETH and 18,270 BTC worth about USD 2.4 billion. TRM linked the preparation and execution pattern to earlier DPRK operations, including the Bybit and KelpDAO thefts.