Blockchain Analysts Tie North Korea to $6.3 Billion Binance Theft

Chainalysis and TRM Labs, two blockchain intelligence companies, have tied the $6.3 billion Binance breach from yesterday to TraderTraitor, a unit linked to North Korea. Should it be verified at that size, the heist would rank as the biggest crypto theft ever recorded.

Chainalysis itself estimates the figure at $6.4 billion. According to the firm, outflows from Binance hot wallets across multiple blockchains began near 4:20 p.m. Eastern Time on October 29.

An operational wallet, financed via Tornado Cash, was used, Chainalysis said, to submit signed approvals that let a Binance hot wallet execute code deployed by the attacker.

After that, funds were pulled into addresses controlled by the attacker. Binance's preliminary probe, the exchange has said, suggests a hacked engineer's laptop gave the intruder access to a service container and made the unauthorized withdrawals possible.

No wallet private key leak has been detected, according to Binance.

The attacker, reports say, moved to stay ahead of freezes by shifting stablecoins into ether and other tokens that issuers lack the ability to freeze. Chainalysis observed a conversion of $325 million in stablecoins into $285 million in ETH in about 20 minutes, followed by a transfer of the remaining $175 million to stopover wallets. The firm says freezes had started by 5:14 p.m. Eastern.

Markets move in wake of hack

On Friday morning, Bitcoin slid toward $76,000 and later changed hands near $77,400. The broader crypto market followed with its own losses. Liquidations across the market came to $1.5 billion — $468 million of that in Bitcoin and $358 million in ether.

Losses hit long positions — wagers on rising prices — hardest. The downturn arrived alongside a separate breach at decentralized betting site Polymarket, which halted international trading once attackers siphoned more than $2.6 million from user accounts.

On Thursday, Binance put the impact of the security incident at roughly $6.3 billion in assets, exceeding the $1.5 billion Bybit hack in 2025 that was blamed on North Korean hackers. Changpeng Zhao, the former CEO, said on X, “It does look like a hack.” Zhao is no longer in charge of the exchange, though he continues to be a major shareholder.

Issuers of stablecoins acted to contain the damage. Paolo Ardoino, Tether's CEO, said the firm had frozen more than $1.567 billion in USDT, calling the protection of the industry and its partners its top priority.

Jeremy Allaire, co-founder and CEO of Circle, said Circle had frozen over $800 million in USDC alongside law enforcement. Vincent Chok, First Digital's CEO, said FDUSD taken in the breach had been frozen. In total, Binance puts onchain freezes at around $3 billion.

Binance says funds are sufficient to cover incident

Binance has earmarked over $6.34 billion of its own funds for this incident. Around $5 billion of that reserve consists of the same token assets affected in the hack, with the rest being purchased through market and over-the-counter channels.

Frozen and safeguarded assets still need to be verified, Binance says, and the exchange intends to release an updated Proof of Reserves.

Reuters, quoting a person with knowledge of the matter, reported that Binance is cooperating with the FBI and the U.S. Secret Service.

Bitcoin could slide further

Geoffrey Kendrick, Standard Chartered's global head of digital assets research, said in an email to CoinDesk that the move lower might not be finished. He expects a fresh base to take shape once frozen assets are released and further details about the hack surface.

In Kendrick's view, the episode could speed up movement toward decentralized exchanges. Chainalysis, meanwhile, has cautioned that impostors are posing as the company, with some offering fund-recovery help and recruitment services.

Those affected should be wary of unsolicited offers to recover funds and should stick to official channels for information.

Bitcoin was last trading around $76,700.