Blockchain analysis firms Chainalysis and TRM Labs have linked the $6.3 billion Binance hack yesterday to TraderTraitor, a unit associated with North Korea. If confirmed at this scale, the theft would be the largest crypto hack on record.
Chainalysis puts the total at $6.4 billion in its own assessment. Chainalysis says funds began leaving Binance hot wallets across multiple blockchains around 4:20 p.m. Eastern Time on October 29.
The firm said the attacker used an operational wallet funded through Tornado Cash to submit signed authorizations that allowed a Binance hot wallet to run attacker-deployed code.
The attacker then swept assets into addresses under its control. Binance has said its initial investigation points to a compromised engineer’s laptop, which gave an attacker access to a service container and enabled unauthorized withdrawals.
The exchange said it has found no evidence of a wallet private key leak.
The attacker reportedly tried to outpace freezes by converting stablecoins into ether and other assets that issuers cannot freeze. Chainalysis said the attacker swapped $325 million in stablecoins into $285 million in ETH over roughly 20 minutes, then sent the remaining $175 million to stopover wallets. Freezes began by 5:14 p.m. Eastern, according to the firm.
Market reacts to the hack
Bitcoin dropped toward $76,000 on Friday morning before trading near $77,400. Other crypto followed suit and posted declines of their own. Total market liquidations reached $1.5 billion, with bitcoin accounting for $468 million and ether for $358 million.
Long positions, which bet on higher prices, bore most of the losses. The sell-off coincided with a separate incident at decentralized betting platform Polymarket, which suspended international trading after hackers drained more than $2.6 million from user accounts.
Binance said Thursday that the security incident affected about $6.3 billion in assets, surpassing the $1.5 billion Bybit hack of 2025, which was attributed to North Korean hackers. Former CEO Changpeng Zhao wrote on X, “It does look like a hack.” Zhao no longer runs the exchange but remains a key shareholder.
Stablecoin issuers moved to contain the fallout. Tether CEO Paolo Ardoino said the company froze more than $1.567 billion in USDT and that protecting the industry and its partners is its main priority.
Circle co-founder and CEO Jeremy Allaire said Circle froze more than $800 million in USDC in coordination with law enforcement. First Digital CEO Vincent Chok said FDUSD stolen in the attack has been frozen. Binance says about $3 billion has been frozen onchain in total.
Binance has enough funds to cover the incident
Binance says it has reserved more than $6.34 billion of company funds to cover the incident. About $5 billion of that reserve is held in the same token assets that were affected, and the company is buying the remainder through market and OTC channels.
The exchange says frozen and protected assets remain subject to verification and plans to publish an updated Proof of Reserves.
Reuters, citing a person familiar with the matter, reported that Binance is working with the FBI and the U.S. Secret Service.
Bitcoin may have further downside
Standard Chartered’s global head of digital assets research, Geoffrey Kendrick, wrote in an email to CoinDesk that the negative price action may have some way to go. He said a new base will form after assets are unfrozen and more details of the hack emerge.
Kendrick argued that the incident could accelerate a shift toward decentralized exchanges. Chainalysis has warned that scammers are impersonating the firm, including those offering fund recovery and recruiting services.
Victims should treat unsolicited recovery offers with caution and rely on official channels for updates.
At the time of writing, Bitcoin is trading near $76,700.
