Blockchain investigators have linked a $6.3 billion hack of Binance to North Korea's Lazarus Group, making it the largest crypto theft on record according to Blockaid. TRM Labs connected the attack with high confidence to TraderTraitor, a North Korean unit affiliated with Lazarus, while blockchain investigator ZachXBT also named Lazarus as the likely attacker. Binance has not confirmed the perpetrator's identity.
The FBI previously attributed the February 2025 Bybit theft, which drained approximately $1.5 billion, to TraderTraitor. U.S. authorities say North Korea conducts crypto thefts to fund weapons programs.
Attack Timeline and Methods
The theft occurred on October 29, with approximately $6.36 billion leaving Binance wallets across ten blockchains including Ethereum, Bitcoin, Tron, Solana, and the XRP Ledger. Most funds moved within 20 minutes starting at 20:05 UTC.
Ethereum accounted for roughly $3.79 billion, followed by Bitcoin at $1.47 billion and Tron at $628 million. Approximately 233.46 million XRP, valued near $296 million, transferred from five Binance wallets before the Ethereum attack began.
TRM Labs determined preparations began at least 36 hours earlier, with a wallet controlled by the attacker receiving Tornado Cash withdrawals and testing malicious code. Blockaid discovered an Ethereum transaction containing 50 EIP-7702 authorizations targeting Binance 14, one of the exchange's primary hot wallets. A single authorization succeeded, allowing a malicious contract to drain funds. Blockaid's CEO stated the attacker effectively reprogrammed the hot wallet so a single operator could extract it, including any subsequently deposited money. Approximately $2.5 billion came from that wallet alone.
Binance attributed the breach to a compromised DevOps engineer's laptop and reported finding no evidence of leaked private keys.
Asset Freezes and Recovery
Tether froze over 1.567 billion USDT, and Circle froze more than 800 million USDC. Binance reported approximately $3 billion in assets frozen in total.
Onchain Lens reported the attacker retained about 480,720 ETH worth roughly $1.08 billion, which cannot be frozen by stablecoin issuers. The attacker recently moved 17,260 ETH to a new wallet, suggesting preparation for fund laundering through mixers.
Binance pledged to cover customer losses using its SAFU fund and company resources. Deposits remain open, but withdrawals are paused during system upgrades, with operations expected to resume within 48 hours.
Market Impact
Crypto liquidations reached $1.53 billion over 24 hours, with long positions comprising approximately $1.29 billion or 83.8% of the total. Bitcoin positions accounted for about $499 million in liquidations, and Ether followed with $358 million. Binance alone recorded $754.6 million, representing 49.2% of all forced closures.
Bitcoin declined to approximately $76,460, nearing its 200-day moving average of $76,457. Ether dipped below $2,200. Bitcoin was on track for a monthly loss of approximately 8%.
Prices subsequently recovered, with Bitcoin moving toward $78,500 and Ether trading near $2,240. In the latest reported hour, short positions comprised $20.6 million of $21.6 million in liquidations.
