TRM Labs says North Korea, with "high confidence." The blockchain analytics firm attributed the theft to TraderTraitor, a unit it places inside the Lazarus Group, citing staging and signature patterns that match the 2025 Bybit theft, which the FBI pinned on the same group, and the April 2026 KelpDAO hack, Bitcoin.com News reported. Independent investigator ZachXBT got there hours earlier: "It's likely the Lazarus Group (DPRK)." No government has formally named a culprit yet. The preparation shows up on chain. Researcher 0xQuit found the attacker's relayer funded by three 0.1 ETH withdrawals from Tornado Cash over the two prior days and a delegate contract deployed at 15:59 UTC, and another analyst says the drain was rehearsed about six hours earlier with three fresh wallets and small test sweeps. At 20:24 UTC, 167,464 ETH left the Binance 14 hot wallet. The laundering has leaned on big trades: about 325 million USDT sold to market makers for roughly 122,300 ETH at a discount of more than 10%, and about 19,760 ETH borrowed on Aave against 60 million USDT. TRM estimates the attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer's reach, and expects bridges, swap services and over-the-counter brokers next. "When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity," said Ari Redbord, TRM's global head of policy.