The source of the attack has not yet been officially confirmed. But the FBI and blockchain analytics company TRM Labs identified North Korea’s TraderTraitor hacking unit as the group most likely to have been behind it. Two other blockchain analytics firms, Chainalysis and Elliptic, have supported this attribution.
This is not the first time North Korea has been linked to cyber-attacks. Several other cryptocurrency exchange thefts in recent years have been attributed to North Korean state-sponsored hackers. These include the 2019 Upbit and 2025 Bybit hacks, where funds worth US$42 million and US$1.5 billion respectively were stolen.