Blockchain analysis firms Chainalysis and TRM Labs have linked a $6.3 billion hack of Binance to TraderTraitor, a unit associated with North Korea. Chainalysis assessed the total at $6.4 billion. If confirmed at this scale, the theft would be the largest crypto hack on record.
Chainalysis said funds began leaving Binance hot wallets across multiple blockchains around 4:20 p.m. Eastern Time on October 29. The attacker used an operational wallet funded through Tornado Cash to submit signed authorizations that allowed a Binance hot wallet to run attacker-deployed code, then swept assets into addresses under its control.
Binance said its initial investigation points to a compromised engineer's laptop, which gave an attacker access to a service container and enabled unauthorized withdrawals. The exchange reported finding no evidence of a wallet private key leak.
The attacker attempted to evade asset freezes by converting stablecoins into ether and other assets that issuers cannot freeze. Chainalysis said the attacker swapped $325 million in stablecoins into $285 million in ETH over roughly 20 minutes, then sent the remaining $175 million to stopover wallets. Freezes began by 5:14 p.m. Eastern.
Market Impact
Bitcoin dropped toward $76,000 on Friday morning before trading near $77,400. Total market liquidations reached $1.5 billion, with bitcoin accounting for $468 million and ether for $358 million. Long positions, which bet on higher prices, bore most of the losses.
Stablecoin issuers moved to contain the fallout. Tether froze more than $1.567 billion in USDT, while Circle froze more than $800 million in USDC in coordination with law enforcement. First Digital froze FDUSD stolen in the attack. Binance reported approximately $3 billion in frozen assets onchain in total.
Response and Recovery
Binance said it has reserved more than $6.34 billion of company funds to cover the incident. About $5 billion of that reserve is held in the same token assets that were affected, with the company acquiring the remainder through market and OTC channels. The exchange said frozen and protected assets remain subject to verification and plans to publish an updated Proof of Reserves.
Reuters reported that Binance is working with the FBI and the U.S. Secret Service. Former CEO Changpeng Zhao, who no longer runs the exchange but remains a key shareholder, wrote on X that it appears to be a hack.
Chainalysis warned that scammers are impersonating the firm, including those offering fund recovery and recruiting services. Victims should treat unsolicited recovery offers with caution and rely on official channels for updates.
