Jony Levin, the CEO of Chainalysis, a blockchain data firm, said on X that the attack carries hallmarks of infiltration by North Korean hacker groups.

“DPRK are up to their old tricks,” Levin said on X. “Industry partners have already frozen ~$3B and we @chainalysis continue to follow all of the funds.”

In a report published on Friday, the Chainalysis team said the North Korean group in question, called TraderTraitor, has repeatedly targeted crypto exchanges to “raise funds for the regime.”

Chainalysis said it was able to link the Binance breach to TraderTraitor because funds stolen from Binance were observed “commingling” with funds stolen in an earlier attack.

“That direct on-chain link strengthened our…