A bizarre situation unfolded in the cryptocurrency world today: hackers were dumping stolen coins from Binance into on-chain pools, while Binance itself was buying back the exact same coins, both on and off the exchange. Even more absurdly, according to two on-chain analytics firms, the seller sitting opposite them is likely from North Korea. According to Decrypt, TRM Labs and Chainalysis both attributed the approximately $6.3 billion theft to the North Korean hacking group TraderTraitor with "high confidence." Chainalysis's strongest evidence is that the stolen funds were seen being mixed in real-time with stolen funds from another platform last month, which have already been attributed to North Korea. TRM, on the other hand, stated that the premeditated tactics are strikingly similar to the approximately $1.5 billion exchange theft in February 2025 and the KelpDAO attack in April of this year. TRM determined that the compromised system was Binance's hot wallet signature system. Binance stated that the investigation began with an engineer's hacked laptop and later uncovered "more vulnerabilities."