Three blockchain analytics firms have attributed this week's hack of Binance to North Korea, with two of the largest—TRM Labs and Chainalysis—naming TraderTraitor, a North Korean hacking group, as responsible for what both describe as the largest cryptocurrency theft on record.

TRM Labs said it made the attribution "with high confidence," based on "robust on and off-chain intelligence." The firm put the theft at about $6.36 billion, moved out of Binance wallets across 10 blockchains, with most of it leaving in roughly 20 minutes starting from 4:05 p.m. ET on Thursday. That is about four times the $1.5 billion Bybit hack of February 2025, which the FBI attributed to the same group, TRM noted.

Chainalysis, which put the total at about $6.4 billion, said the strongest evidence came when its investigators saw funds stolen from Binance commingling in real time with proceeds from last month's Bitget exploit, which had been attributed to North Korean actors. A Chainalysis spokesperson told CNN the firm had "high confidence" that North Korea was behind the hack.

Singapore-based Pangolin Intelligence also told CNN it believed a North Korean hacking unit was responsible, based on "analyzing the on-chain activity related to this hack and correlating with information gathered from previous known incidents." North Korea has previously denied hacking allegations.

How the attack worked

TRM and Chainalysis both said the attacker's operational wallet was funded through Tornado Cash, a crypto mixer. TRM said that, along with other features—including staging that began well before the theft—matched earlier North Korea-linked attacks such as the Bybit hack and April's KelpDAO exploit.

On Ethereum, the attacker used an EIP-7702 delegation—a feature introduced in Ethereum's Pectra upgrade that lets an ordinary wallet run smart contract code—to turn a Binance hot wallet (an internet-connected wallet) into a sweeper under its control, with 50 pre-signed authorizations prepared in advance, according to TRM. A sweeper automatically transfers out any funds sent to an address. Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers. In TRM's assessment, that points to a compromise of Binance's hot wallet signing infrastructure.

Binance has said its investigation began with a compromised engineer's laptop, but has since uncovered "additional points of breach." The Bybit attack also began with a single compromised machine: North Korean hackers planted malicious code in the infrastructure of wallet provider Safe after compromising a Safe developer's computer, Decrypt reported at the time.

Rapid laundering, mounting freezes

The attacker has moved quickly to launder what it could not keep. Chainalysis said it is seeing "never-seen-before laundering patterns," with thousands of transactions in a short period suggesting the use of automation to circulate funds repeatedly among addresses.

The attacker also sold USDT to market makers and borrowed ETH against USDT on the lending protocol Aave to race issuers' freezes, according to TRM, and now holds more than 420,000 ETH and 18,270 BTC—about $2.4 billion beyond the reach of any issuer, since neither ETH nor BTC has an issuing company able to freeze them.

Tether, Circle, Ripple and World Liberty Financial have frozen about $2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB, TRM said. Binance puts the total frozen at about $3 billion.

Binance commits to covering user losses

Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.

Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds. The company has already publicly committed to cover losses through… pic.twitter.com/UqtBd37Fpj

— Binance (@binance) October 30, 2026

In an update on Friday, the exchange said it has reserved more than $6.34 billion of company funds to cover the incident, $5 billion of which is already held in the exact tokens that were stolen. It is buying the rest through market and over-the-counter channels, which "can take longer because some tokens may have low liquidity," Binance said. Those figures do not include frozen assets. How quickly those purchases can be completed, the full scope of the breach, and whether more of the stolen funds can be frozen or recovered remain open questions as the investigation continues.

"We will weather this storm," Binance said.

A long-running adversary

North Korean hackers have long targeted the exchange. In August 2025, Binance Chief Security Officer Jimmy Su told Decrypt that North Korean attackers try to get hired at Binance every day, and called them the single biggest threat to crypto companies.

On Wednesday—the day before the theft began—the U.S. Treasury sanctioned 10 individuals and one entity over North Korean IT worker schemes that moved millions of dollars in crypto.