Blockchain intelligence firms Chainalysis, TRM Labs and Elliptic have tied the $6.3 billion theft from Binance to Pyongyang. If confirmed at that scale, the North Korea Binance hack would be the largest crypto theft on record. On Friday, October 30, 2026, a day after the funds were drained, Chainalysis and TRM Labs linked the attack to TraderTraitor, the FBI’s name for a strand of North Korean cyber activity.
- Binance says about $6.3 billion was affected. Chainalysis puts it at $6.4 billion, TRM Labs at roughly $6.36 billion across ten blockchains.
- Roughly $3 billion is frozen onchain, including more than $1.567 billion in USDT frozen by Tether and more than $800 million in USDC frozen by Circle.
- Binance says it has reserved more than $6.34 billion of company funds and found no evidence of a wallet private key leak.
- Its initial investigation points to a compromised engineer’s laptop that gave the attacker access to a service container.
Timeline of the North Korea Binance hack
- October 29, around 4:20 p.m. ET: Funds start leaving Binance hot wallets across multiple blockchains, according to Chainalysis.
- The next 20 minutes or so: The attacker swaps $325 million in stablecoins into $285 million in ETH and sends the remaining $175 million to stopover wallets.
- By 5:14 p.m. ET: Freezes begin.
- Later on October 29: Binance discloses the incident. Former CEO Changpeng Zhao writes that it “does look like a hack.”
- October 30: Binance calls it a “complex attack” and starts recovering assets for users. The three firms attribute the theft to North Korean hackers, and bitcoin briefly slides to about $76,300.
How the attack worked and why TraderTraitor fits
As Bitcoin Magazine reported, Chainalysis says the attacker used a wallet funded through Tornado Cash to submit signed authorizations that let a Binance hot wallet run attacker-deployed code. The assets were then swept into attacker-controlled addresses. Our explainer on the Binance hot wallet exploit covers the mechanics.
Speed mattered. The attacker reportedly tried to outpace freezes by converting stablecoins into ether and other assets issuers can’t freeze. In a statement quoted by CBS News, TRM Labs said most of the funds moved in about 20 minutes and that “several features of this attack match earlier North Korea-linked heists, including the Bybit hack.”
The FBI blamed North Korea for the roughly $1.5 billion Bybit theft and used the TraderTraitor name for that activity, NBC News reported. Chainalysis data shows North Korea stole a record $2.02 billion in crypto in 2025, about 60% of the $3.4 billion taken worldwide. This single attack would be worth more than three times that haul.
Binance, stablecoin issuers and analysts respond
Binance hasn’t endorsed the North Korea link. A spokesperson told CBC News only that the company is “working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice.” Reuters, citing a person familiar with the matter, reported that Binance is working with the FBI and the U.S. Secret Service.
Zhao, who no longer runs the exchange but remains a key shareholder, posted that “User funds are safe!” and said he expects all user funds to be “fully covered.” Binance says about $5 billion of its reserve is held in the affected tokens. It is buying the rest through market and OTC channels.
Tether CEO Paolo Ardoino said protecting the industry and its partners was the main priority. Circle CEO Jeremy Allaire said the USDC freeze was coordinated with law enforcement, and First Digital CEO Vincent Chok said stolen FDUSD had been frozen. According to CNBC, Chainalysis CEO Jonathan Levin said the TraderTraitor assessment cites links to previous attacks.
Market reaction to the Binance theft
Long positions took most of the $1.5 billion in market-wide liquidations, with bitcoin accounting for $468 million and ether for $358 million. Our report on how the Binance hack hit leveraged bitcoin bulls tracks the forced selling. The Crypto Fear and Greed Index stood at 30 (“Fear”) on October 30. Prices below are CoinGecko data.
| Asset | Price (Oct 30, 16:13 UTC) | 24h change | 24h low |
|---|---|---|---|
| Bitcoin (BTC) | $77,407 | -5.17% | $76,443 |
| Ethereum (ETH) | $2,227.67 | -5.88% | $2,178.62 |
| BNB | $700.22 | -6.78% | $682.36 |
| Solana (SOL) | $94.91 | -7.44% | $92.64 |
The sell-off overlapped with a separate incident at Polymarket, which suspended international trading after hackers drained more than $2.6 million from user accounts.
What to watch next
Binance says it will release more technical details once its probe is complete, NPR reported. It also plans an updated Proof of Reserves and says frozen and protected assets remain subject to verification. An analyst estimate cited by CNBC puts the assets still unfrozen at about $3.3 billion, assuming frozen stablecoins are eventually returned. On that basis, Binance’s roughly $1.2 billion SAFU fund could cover about a third of the remaining losses, with company money covering the rest.
Standard Chartered’s Geoffrey Kendrick wrote in an email to CoinDesk that the decline may have further to go, with a new base forming once assets are unfrozen and more details emerge. He also argued the incident could speed a shift toward decentralized exchanges. That’s a forecast, not a certainty.
Funds held on any exchange carry counterparty and operational risk, however large the platform. Chainalysis has also warned that scammers are impersonating the firm with fake recovery and recruiting offers. Treat unsolicited recovery pitches with suspicion and rely on official channels.
North Korea Binance hack FAQ
Who is behind the North Korea Binance hack?
Chainalysis assesses that TraderTraitor likely carried out the attack, and TRM Labs and Elliptic also point to North Korea. Binance hasn’t confirmed the link.
Are Binance user funds covered after the hack?
Binance says it has reserved more than $6.34 billion of company funds. Those figures are still subject to verification.
How much of the stolen crypto has been frozen?
About $3 billion, mainly stablecoins frozen by Tether, Circle and First Digital. Assets swapped into ETH can’t be frozen by issuers.
Sources
- Blockchain Firms Link North Korea to $6.3 Billion Binance Hack (Bitcoin Magazine)
- $6.3 billion Binance hack was likely work of North Korea, blockchain intel firms say – CBS News (www.cbsnews.com)
- Binance's $6.3 billion hack: What we know and what comes next (www.cnbc.com)
- Blockchain intelligence firms link North Korea to $6.3B hack on Binance : NPR (www.npr.org)
- Binance says $6.3B US hacked in what could be largest cryptocurrency theft ever (www.cbc.ca)
- North Korea was responsible for $1.5 billion ByBit hack, FBI says (www.nbcnews.com)
This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.
For advertising inquiries, please email . [email protected] or Telegram
