Blockchain intelligence organizations Chainalysis and TRM Labs have connected the recent $6.3 billion Binance breach to TraderTraitor, a collective linked to North Korea. Should this figure be officially verified, the breach would stand as the largest cryptocurrency exploit in history.
In its independent evaluation, Chainalysis estimates the aggregate loss at $6.4 billion. According to Chainalysis, funds started moving away from Binance hot wallets across multiple chains beginning around 4:20 p.m. Eastern Time on October 29.
The analytics company noted that the perpetrator utilized an operational wallet funded via Tornado Cash to submit authenticated commands, which in turn permitted a Binance hot wallet to execute code supplied by the intruder.
Following that, the hacker transferred digital assets into addresses under their direct control. Binance noted that its preliminary review points toward a compromised engineer laptop, granting the adversary entry to a service container and enabling illicit withdrawals.
The trading platform stated it discovered zero proof of any wallet private key compromise.
Reports indicate the culprit attempted to outpace asset freezes by exchanging stablecoins for ether alongside other tokens that issuers cannot freeze. Chainalysis reported that the attacker converted $325 million worth of stablecoins into $285 million in ETH within a span of roughly 20 minutes, subsequently routing the remaining $175 million to intermediary wallets. Asset freezing actions commenced by 5:14 p.m. Eastern, based on the firm’s data.
Market reacts to the hack
Bitcoin retreated toward $76,000 on Friday morning prior to hovering near $77,400. Alternative digital currencies experienced comparable downward trends. Overall market liquidations hit $1.5 billion, with bitcoin representing $468 million and ether making up $358 million.
Long positions, which anticipate higher valuations, suffered the majority of these setbacks. This market sell-off coincided with a separate event at decentralized prediction market Polymarket, which halted international transactions after bad actors drained over $2.6 million from customer balances.
Binance announced on Thursday that the security breach impacted approximately $6.3 billion in holdings, eclipsing the $1.5 billion Bybit exploit from 2025, which was likewise blamed on North Korean threat actors. Former CEO Changpeng Zhao shared on X, “It does look like a hack.” Zhao no longer manages daily operations at the exchange but remains a major stakeholder.
Stablecoin creators moved swiftly to mitigate the impact. Tether Chief Executive Officer Paolo Ardoino stated that his organization locked over $1.567 billion in USDT, emphasizing that safeguarding the sector and its partners serves as their top priority.
Circle co-founder and Chief Executive Officer Jeremy Allaire mentioned that Circle froze in excess of $800 million in USDC in partnership with law enforcement agencies. First Digital Chief Executive Officer Vincent Chok noted that stolen FDUSD tokens tied to the breach have been blocked. Binance estimates that roughly $3 billion has been frozen onchain overall.
Binance has enough funds to cover the incident
Binance reports that it has set aside over $6.34 billion in corporate capital to address the situation. Roughly $5 billion of that reserve sits in the exact same token denominations that were impacted, and the business is actively acquiring the rest through open market and OTC pathways.
The exchange clarified that frozen and secured funds remain subject to validation checks and intends to release an updated Proof of Reserves report.
Reuters, referencing an individual familiar with the situation, shared that Binance is collaborating closely with the Federal Bureau of Investigation and the U.S. Secret Service.
Bitcoin may have further downside
Geoffrey Kendrick, global head of digital assets research at Standard Chartered, conveyed in an email directed to CoinDesk that this negative price trajectory might persist further. He suggested that a fresh market floor will develop once funds are unfrozen and further specifics regarding the exploit come to light.
Kendrick contended that the event could potentially hasten a migration toward decentralized trading venues. Meanwhile, Chainalysis issued a warning that bad actors are posing as the company, including entities falsely promising asset recovery or hiring opportunities.
Affected individuals ought to approach unrequested recovery pitches with skepticism and depend strictly on official communication channels for updates.
At the time of composition, Bitcoin exchanges near $76,700.
Originally published at https://bitcoinmagazine.com/news/north-korea-6-3-billion-binance-hack.
