Blockchain analysis organizations TRM Labs and Chainalysis have connected the $6.3 billion Binance security breach to TraderTraitor, a North Korea-linked faction. Should this magnitude be verified, the event would rank as the largest cryptocurrency theft in history.
In its personal evaluation, Chainalysis estimates the aggregate sum at $6.4 billion. According to the firm, capital started moving away from Binance hot wallets across multiple blockchains around 4:20 p.m. Eastern Time on October 29.
The company stated that the perpetrator utilized an operational wallet—initially funded via Tornado Cash—to submit signed authorizations, permitting a Binance hot wallet to execute attacker-supplied code.
Subsequently, the wrongdoer swept the digital assets into addresses under their supervision. Binance announced that its preliminary review indicates a compromised engineer laptop gave an unauthorized user access to a service container, facilitating the illicit withdrawals.
The exchange noted that it discovered no indicators of a leaked wallet private key.
Reports indicate the intruder attempted to outrun asset freezes by exchanging stablecoins for ether and alternative digital currencies that issuers cannot freeze. Chainalysis reported that the perpetrator swapped $325 million in stablecoins for $285 million in ETH within roughly a 20-minute span, subsequently funneling the remaining $175 million to intermediary stopover wallets. Asset freezes commenced by 5:14 p.m. Eastern time, per the analysis firm.
Market reacts to the hack
Bitcoin pulled back toward $76,000 on Friday morning before stabilizing near $77,400. Other digital assets followed a similar trajectory, registering their own losses. Overall market liquidations hit $1.5 billion, with Bitcoin responsible for $468 million and ether making up $358 million.
Long positions, which anticipate upward price movement, absorbed the majority of these downturns. This market sell-off coincided with a separate security event at decentralized prediction market Polymarket, which paused international operations after malicious actors drained upwards of $2.6 million from user accounts.
On Thursday, Binance reported that the security breach impacted roughly $6.3 billion worth of assets, eclipsing the $1.5 billion Bybit breach from 2025, which was likewise blamed on North Korean threat actors. Former CEO Changpeng Zhao shared on X, “It does look like a hack.” Zhao no longer manages daily operations at the exchange, though he remains a principal shareholder.
Stablecoin administrators took swift action to limit the fallout. Tether CEO Paolo Ardoino stated that his organization locked more than $1.567 billion in USDT, emphasizing that safeguarding the broader industry and its collaborators remains a top priority.
Circle co-founder and CEO Jeremy Allaire stated that Circle froze upward of $800 million in USDC in cooperation with law enforcement agencies. First Digital CEO Vincent Chok confirmed that FDUSD stolen during the attack has similarly been frozen. Binance estimates that roughly $3 billion has been frozen on-chain altogether.
Binance has enough funds to cover the incident
Binance asserted that it has set aside in excess of $6.34 billion in corporate funds to address the breach. Roughly $5 billion of that reserve consists of the exact token assets impacted by the exploit, with the company acquiring the remainder via open market and OTC channels.
The exchange clarified that frozen and secured funds remain subject to validation checks, and it intends to release a refreshed Proof of Reserves report.
Reuters, citing an individual with direct knowledge of the situation, disclosed that Binance is collaborating closely with the FBI and the U.S. Secret Service.
Bitcoin may have further downside
Geoffrey Kendrick, global head of digital assets research at Standard Chartered, noted in an email to CoinDesk that the downward price pressure could persist for some time. He projected that a new market floor will form once the frozen funds are released and additional details regarding the breach come to light.
Kendrick suggested the event might accelerate user migration toward decentralized exchanges. Meanwhile, Chainalysis issued a warning regarding fraudsters impersonating the analytics firm, including bad actors promoting fake fund recovery and recruitment services.
Affected individuals should exercise extreme caution toward unsolicited asset recovery proposals and depend solely on official communication channels for updates.
At the time of publication, Bitcoin changes hands near $76,700.
FAQ
Who is blamed for the Binance hack?
Blockchain analysis firms Chainalysis and TRM Labs have linked the breach to TraderTraitor, a unit associated with North Korea.
How much was stolen in the Binance incident?
Binance reported that the security incident affected about $6.3 billion in assets, while Chainalysis puts the total at $6.4 billion.
How is Binance covering the stolen funds?
Binance has reserved more than $6.34 billion of company funds to cover the incident, acquiring the remainder through market and OTC channels.
What did stablecoin issuers do after the hack?
Tether froze over $1.567 billion in USDT, Circle froze more than $800 million in USDC, and First Digital froze stolen FDUSD.
