Blockchain analysis firms Chainalysis and TRM Labs have attributed the $6.3 billion hack of Binance to TraderTraitor, a unit associated with North Korea whose name has appeared in prior U.S. government advisories on cryptocurrency theft. If confirmed at this scale, the theft would be the largest cryptocurrency hack on record, surpassing the $1.5 billion Bybit breach of 2025, which was also attributed to North Korean hackers.

Chainalysis, which laid out its findings in a blog post, put the total at $6.4 billion in its own assessment. According to the firm, funds began leaving Binance hot wallets across multiple blockchains at around 4:20 p.m. Eastern Time on October 29.

The firm said the attacker used an operational wallet funded through Tornado Cash, a mixing service used to obscure the origin of funds, to submit signed authorizations that allowed a Binance hot wallet to run attacker-deployed code, then swept assets into addresses under its control. Binance said its initial investigation points to a compromised engineer’s laptop, which gave the attacker access to a service container and enabled unauthorized withdrawals. The exchange added that it has found no evidence of a wallet private key leak. The sequence shows how a single compromised endpoint can escalate into hot-wallet access, the kind of operational risk that exchange security teams work to contain.

Attempting to outpace freezes, the attacker converted stablecoins into ether and other assets that issuers cannot freeze. The swap reflected a structural feature of the market: tokens such as USDT and USDC can be frozen by their issuers, while ether cannot be frozen at the protocol level. Chainalysis said $325 million in stablecoins was swapped into $285 million in ETH over roughly 20 minutes, and the remaining $175 million was sent to stopover wallets. Freezes began by 5:14 p.m. Eastern, according to the firm.

Market Reaction

Bitcoin dropped toward $76,000 on Friday morning before trading near $77,400, and other cryptocurrencies posted declines of their own. Total market liquidations reached $1.5 billion, with bitcoin accounting for $468 million and ether for $358 million. Long positions, which bet on higher prices, bore most of the losses. Liquidations happen when leveraged positions are forcibly closed after price moves erode their collateral.

The sell-off coincided with a separate incident at decentralized betting platform Polymarket, which suspended international trading after hackers drained more than $2.6 million from user accounts.

Binance said Thursday in a post on X that the security incident affected about $6.3 billion in assets. Former CEO Changpeng Zhao wrote on X, “It does look like a hack.” Zhao no longer runs the exchange but remains a key shareholder.

Stablecoin Issuers Freeze Stolen Funds

Tether CEO Paolo Ardoino said the company froze more than $1.567 billion in USDT and that protecting the industry and its partners is its main priority. Circle co-founder and CEO Jeremy Allaire said Circle froze more than $800 million in USDC in coordination with law enforcement. First Digital CEO Vincent Chok said the FDUSD stolen in the attack has been frozen. In total, Binance says about $3 billion has been frozen onchain.

Binance Says It Has Enough Funds to Cover the Incident

Binance says it has reserved more than $6.34 billion of company funds to cover the incident. About $5 billion of that reserve is held in the same token assets that were affected, and the company is buying the remainder through market and over-the-counter channels. The exchange said frozen and protected assets remain subject to verification and that it plans to publish an updated Proof of Reserves, an attestation intended to show that an exchange holds reserves sufficient to cover customer balances.

Reuters, citing a person familiar with the matter, reported that Binance is working with the FBI and the U.S. Secret Service.

Bitcoin May Have Further Downside

Standard Chartered’s global head of digital assets research, Geoffrey Kendrick, wrote in an email to CoinDesk that the negative price action may have some way to go. He said a new base will form after assets are unfrozen and more details of the hack emerge, and argued the incident could accelerate a shift toward decentralized exchanges, which allow users to retain custody of their own assets rather than relying on an intermediary.

Chainalysis has meanwhile warned that scammers are impersonating the firm, including some offering fund recovery and recruiting services. Victims should treat unsolicited recovery offers with caution and rely on official channels for updates.

At the time of writing, bitcoin is trading near $76,700.

This article is based on reporting by Micah Zimmerman for Bitcoin Magazine.