Chainalysis and TRM Labs have linked the $6.3 billion Binance hack to TraderTraitor, a North Korean-associated unit. If confirmed at that scale, the theft would be the largest crypto hack on record. Chainalysis put the total stolen at $6.4 billion, while Binance reported roughly $6.3 billion in affected assets.
How the funds left
Assets started moving out of Binance hot wallets across multiple blockchains around 4:20 p.m. Eastern Time on October 29. The attacker used an operational wallet funded through Tornado Cash to submit signed authorizations that let a Binance hot wallet run attacker-deployed code, then swept assets to controlled addresses. Binance's initial investigation points to a compromised engineer's laptop that gave an attacker access to a service container and enabled unauthorized withdrawals. The exchange said it found no evidence of a wallet private key leak. Freezes began by 5:14 p.m. Eastern Time, under an hour after the first outflows.
The stablecoin carve-out
The attacker swapped $325 million in stablecoins into $285 million in ETH over roughly 20 minutes, then sent the remaining $175 million to stopover wallets. That move didn't escape the issuers. Tether CEO Paolo Ardoino said the company froze more than $1.567 billion in USDT. Circle co-founder and CEO Jeremy Allaire said Circle froze more than $800 million in USDC in coordination with law enforcement. First Digital CEO Vincent Chok said FDUSD stolen in the attack has been frozen. Binance says about $3 billion has been frozen onchain in total, and that frozen and protected assets remain subject to verification.
Binance's own backstop
The exchange says it has reserved more than $6.34 billion of company funds to cover the incident. About $5 billion is held in the same token assets that were affected, and the remainder is being bought through market and OTC channels. Binance plans to publish an updated Proof of Reserves. Reuters, citing a person familiar with the matter, reported that Binance is working with the FBI and the U.S. Secret Service. Former CEO Changpeng Zhao, who no longer runs the exchange but remains a key shareholder, wrote on X: 'It does look like a hack.'
A sell-off with company
Bitcoin dropped toward $76,000 on Friday morning before trading near $77,400 and settling near $76,700 at the time of writing. Total market liquidations reached $1.5 billion, with bitcoin accounting for $468 million and ether for $358 million. Long positions bore most of the losses. The damage wasn't confined to spot markets. Decentralized betting platform Polymarket suspended international trading after hackers drained more than $2.6 million from user accounts, a hit that landed alongside the Binance sell-off. The Binance incident also surpasses the $1.5 billion Bybit hack of 2025, which was attributed to North Korean hackers.
Price calls and fresh targets
Standard Chartered's Geoffrey Kendrick wrote that the negative price action may have further to go and that a new base will form after assets are unfrozen and more details emerge. He argued the incident could accelerate a shift toward decentralized exchanges — a call that sits awkwardly next to Polymarket's outage, though the two events aren't the same thing. Chainalysis, meanwhile, warned that scammers are impersonating the firm, including offering fund recovery and recruiting services, and said victims should treat unsolicited recovery offers with caution.
The open question is verification. Binance has said the frozen and protected assets still need to be checked, and its updated Proof of Reserves will be the first public accounting of how much of the $6.34 billion backstop is actually in place. Until that lands, the $6.3 billion figure is Binance's own, and the $6.4 billion is Chainalysis's.
