Chainalysis Ties $6.4 Billion Binance Hack to North Korea

Chainalysis attributed the $6.4 billion theft from Binance to North Korea's TraderTraitor in a blog post published Oct. 30, joining TRM Labs in naming the group behind what it called the largest theft in crypto history. The firm said its assessment rests on the on-chain activity its investigators observed in the hours after the breach.

Funds began leaving Binance hot wallets across multiple blockchains at around 4:20 p.m. ET on Oct. 29, with unauthorized transfers totaling roughly $6.4 billion, according to the post. On Ethereum, an operational wallet funded through Tornado Cash submitted valid signed authorizations that allowed a Binance hot wallet to run attacker-deployed code. The attacker then called that wallet to sweep its assets into addresses it controlled, while affected Binance wallets on other chains sent funds through ordinary signed transfers.

A large part of the haul sat in stablecoins that issuers could freeze, which set up a race. Chainalysis said the attacker moved $500 million of stablecoins into a dedicated wallet and swapped $325 million of them into $285 million in ETH over nearly 20 minutes, then sent the remaining $175 million to stopover wallets. Billions of dollars of the take was denominated in cryptocurrencies such as bitcoin and ether that issuers cannot freeze, while the rest sat in USDT and USDC that could be. Freezes started by 5:14 p.m. ET, and approximately $2.8 billion has been immobilized so far, the firm said. Chainalysis shared investigative leads with industry partners to help identify and freeze assets before they moved beyond issuers' control.

The decisive evidence came from commingling. Chainalysis investigators watched funds stolen from Binance mix in real time with proceeds of the Bitget exploit, which had already been attributed to North Korean actors, the post said. That direct on-chain link between the two thefts strengthened the assessment that TraderTraitor carried out the Binance attack, and the firm announced the attribution at 12:30 a.m. ET on Oct. 30.

The laundering itself looked automated. Chainalysis reported thousands of transactions in a short period, with funds repeatedly circulated among addresses rather than moved onward. Many addresses follow the same sequence: they receive exactly 1 TRX, then additional funds, then forward everything onward, a pattern the firm said suggests a programmatic process for redistributing the stolen assets.

Three blockchain analytics firms have blamed North Korea for the hack, with the two largest naming TraderTraitor, Decrypt reported. A Chainalysis spokesperson told CNN the company had high confidence in the conclusion, and Singapore-based Pangolin Intelligence said it also believed a North Korean unit was responsible after correlating on-chain activity with previous known incidents. North Korea has previously denied hacking allegations.

TRM Labs put the theft at about $6.36 billion moved from Binance wallets on 10 blockchains, most of it in roughly 20 minutes starting at 4:05 p.m. ET on Oct. 29, and said the total is about four times the $1.5 billion Bybit hack of February 2025 that the FBI attributed to the same group. On Ethereum the attacker used an EIP-7702 delegation, a feature that lets an ordinary wallet run smart contract code, with 50 pre-signed authorizations prepared in advance, TRM said. The firm also found that the attacker sold USDT to market makers and borrowed ETH against USDT on the lending protocol Aave to outrace the freezes.

Binance has reserved more than $6.34 billion of company funds to cover the losses, about $5 billion of it already held in the stolen tokens, and is buying the remainder through market and over-the-counter channels, according to Decrypt. "We will weather this storm," the exchange said.

Tether, Circle, Ripple and World Liberty Financial have frozen about $2.67 billion in stablecoins, while Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB, TRM said. Binance has put the total frozen at around $3 billion and estimated the incident's impact at roughly $6.3 billion, saying it began with a compromised engineer's laptop before investigators uncovered additional points of breach.

Chainalysis said its investigation is ongoing and it expects the stolen funds to keep moving in the coming days. TRM estimates the attacker now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer's reach.