TRM Labs blamed TraderTraitor for the Binance attack.

Based on on-chain and off-chain intelligence analysis, TRM Labs attributed the Binance attack to the North Korean hacking group TraderTraitor, which is affiliated with the North Korean hacking group Lazarus Group.