Chainalysis and TRM Labs Tie $6.3B Binance Hack to North Korea's TraderTraitor

Blockchain analytics firms Chainalysis and TRM Labs have attributed the $6.3 billion theft from Binance to TraderTraitor, a hacking unit linked to North Korea. If the figure holds, it's the largest crypto hack on record, more than four times the $1.5 billion Bybit theft of 2025, which was also blamed on North Korean actors.

Chainalysis's own assessment puts the total slightly higher, at $6.4 billion. The firm's on-chain findings show funds began leaving Binance hot wallets across multiple blockchains at approximately 4:20 p.m. Eastern Time on October 29.

How did the attacker pull it off?

According to Chainalysis, the attacker used an operational wallet funded through Tornado Cash to submit signed authorizations that let a Binance hot wallet execute attacker-deployed code. From there, the attacker swept assets into addresses under their control.

Binance says its initial investigation points to a compromised engineer's laptop, which gave the intruder access to a service container and enabled the unauthorized withdrawals. The exchange says it has found no evidence of a private key leak.

The attacker worked fast to beat freezes. Chainalysis reports the attacker swapped $325 million in stablecoins into $285 million of ether in roughly 20 minutes, assets issuers cannot blacklist, then moved the remaining $175 million to stopover wallets. Freezes began at 5:14 p.m. Eastern.

Former Binance CEO Changpeng Zhao, who no longer runs the exchange but remains a key shareholder, wrote on X: "It does look like a hack."

What have issuers and regulators done?

Stablecoin issuers moved quickly to contain the damage:

• Tether froze more than $1.567 billion in USDT. CEO Paolo Ardoino said protecting the industry and its partners is the company's main priority.
• Circle froze more than $800 million in USDC, with CEO Jeremy Allaire saying it acted in coordination with law enforcement.
• First Digital CEO Vincent Chok confirmed stolen FDUSD has been frozen.

Binance says roughly $3 billion has been frozen onchain in total. Reuters, citing a person familiar with the matter, reported that the exchange is working with the FBI and the U.S. Secret Service.

On solvency, Binance says it has reserved more than $6.34 billion of company funds to cover the incident. About $5 billion of that reserve sits in the same token assets that were affected; the exchange is buying the remainder through market and OTC channels. It plans to publish an updated Proof of Reserves, and notes frozen and protected assets remain subject to verification.

What happened to markets?

Bitcoin slid toward $76,000 on Friday morning before recovering to trade near $77,400, and at the time of writing sits around $76,700. Total market liquidations hit $1.5 billion, with bitcoin accounting for $468 million and ether for $358 million. Long positions took most of the losses.

The sell-off coincided with a separate incident at Polymarket, the decentralized betting platform, which suspended international trading after hackers drained more than $2.6 million from user accounts, the Wall Street Journal reported.

Standard Chartered's global head of digital assets research, Geoffrey Kendrick, wrote in an email to CoinDesk that the negative price action may have further to run, and that a new base will form only after frozen assets are released and more hack details surface. He also argued the incident could accelerate a shift toward decentralized exchanges.

Chainalysis has separately warned that scammers are impersonating the firm, offering fake fund recovery and recruiting services. Anyone affected should treat unsolicited recovery offers with caution and rely on official channels.

With federal agencies now involved and roughly half the stolen funds still unfrozen, the next window that matters is Binance's updated Proof of Reserves and the pace of issuer-blacklisted recoveries.