North Korea-Linked Hackers Took $6.36B From Binance on Oct. 29

The attackers the FBI ties to North Korea stole $6.36 billion from Binance hot wallets on October 29, according to TRM Labs. A Crypto Briefing Pro investigation, using data through November 4, 2026, traces the theft and the assets’ subsequent movement. Subsequent freezes caught most of the stolen stablecoins but none of the bitcoin; the loss equaled 13.6 times North Korea’s goods exports in 2025.

Elliptic tracked roughly 12,000 attacker wallets across 11 chains in a 3.5-day dispersal period. That footprint shows how quickly the stolen inventory fragmented after the transfer, multiplying the endpoints at which a freeze, compliance review or sale could occur. The summary does not identify the 11 chains, so the route cannot be reconstructed from this item alone.

The report describes North Korea-linked thefts as growing fast, with totals increasing every year since 2023. It treats that sequence as a base for identifying which assets may absorb flows from the next large theft, rather than as a one-off incident.

It also follows what became of North Korea’s previous theft above $1 billion, extending the analysis beyond this transfer.

What survived the first freezes?

Freezes caught most of the stolen stablecoins and none of the bitcoin. That asset-level outcome matters more than the headline wallet count because it determines which balances could still reach a market. The report also examines the sale activity that occurred before the first freeze landed.

• Stablecoins: Freezes caught most of the stolen supply.
• Bitcoin: Freezes caught none; 18,270 BTC survived.
• Ether: Roughly 584,000 ETH survived.

The public summary does not name the venues, counterparties or chains holding those assets, and it does not disclose the amount sold before the first freeze. Consequently, this item does not establish how much of the theft reached trading liquidity.

Why the asset mix changes enforcement

The report’s central operational lesson is that freeze effectiveness varied by asset, not merely by wallet or chain. A cross-chain transfer process may disperse exposure quickly, but the ability to stop value depends on whether the relevant asset supports the freeze mechanism used. The source attributes the stablecoin result to freezes and identifies bitcoin as the exception; it provides no breakdown for ETH.

The report links that accelerating series to the assets likely to absorb the next large inflow. It also finds that one token carried more price risk than ETH or BTC after the hack, comparing it with four other exchange tokens. The summary does not name that token or its comparators and supplies no measurements, limiting what readers can infer.

What does this change for traders and compliance teams?

For compliance teams, the cross-chain alert marked exposure, not final containment. Roughly 584,000 ETH and 18,270 BTC remained available for further movement, so monitoring must follow wallet consolidation, transfers and eventual exchange deposits rather than the initial outflow alone.

For traders and market makers, the relevant signal is not the $6.36 billion headline by itself. It is whether the dispersed wallets begin moving assets into order books or venues where enforcement can act again. The report’s comparison of an unnamed token with ETH, BTC and four exchange tokens points to where risk transmission may concentrate, but the lack of names and figures makes it unsuitable as a stand-alone trading input.

The next enforcement window will open when surviving wallets consolidate or transfer toward a trading venue, testing whether selective freezes can contain a much larger flow.