$6.3 Billion Binance Hack Is the Biggest Crypto Theft on Record, Analysts Say, and They Point to North Korea

The Binance hack, which affected roughly $6.3 billion in assets, is being described by analysts as the largest cryptocurrency theft ever recorded. Two US blockchain analysis firms, TRM Labs and Chainalysis, have tied it to a North Korean hacking unit known as TraderTraitor. Binance itself has not confirmed that attribution.

The attribution comes from the analytics firms, not from Binance or a government. TRM Labs said it reached its judgment “with high confidence.” Chainalysis CEO Jonathan Levin wrote that the theft was “likely done by” the group. Asked about the North Korea link, a Binance spokesperson said only that the company is working with law enforcement to confirm the identity of the criminals. North Korea’s mission in Geneva and its embassy in China did not immediately respond to requests for comment.

How the Binance hack unfolded

According to Chainalysis, funds began leaving Binance hot wallets around 4:20 p.m. Eastern on October 29. TRM said the attacker moved about $6.36 billion across ten blockchains, most of it in around 20 minutes. Chainalysis’s own tally is slightly higher, at $6.4 billion.

Chainalysis described an operational wallet funded through the Tornado Cash mixing service. It said the wallet submitted signed authorizations that let a Binance hot wallet run code the attacker had deployed. Assets were then swept into addresses the attacker controlled.

The thieves also appear to have raced the clock. Chainalysis says they swapped $325 million in stablecoins for $285 million in ether, since issuers can freeze stablecoins but not ether. They sent another $175 million to intermediate wallets. Freezes began by 5:14 p.m. Eastern, less than an hour after the first withdrawals.

Binance’s account of the entry point has shifted. Its first findings pointed to a compromised engineer’s laptop that gave access to a service container. It later said further investigation had uncovered additional “points of breach.” The exchange says it has found no evidence of a wallet private key leak and has promised more technical detail once its probe is finished. Kok Tin Gan, CEO of security firm NyxLab, said the pattern looks like a single signature handing the attacker a never-expiring, full-access token. He asked why stronger approval controls were not in place.

Frozen funds and promises to cover losses

Binance says about $3 billion has been frozen onchain. Tether’s CEO said it froze more than $1.567 billion in USDT, and Circle said it froze over $800 million in USDC in coordination with law enforcement. The issuer of FDUSD said the stolen tokens of that type are frozen too. The fate of the remaining roughly $3.3 billion has not been spelled out.

Users are being told they will not bear the loss. Binance says it has set aside more than $6.34 billion of company funds, about $5 billion of it in the same token types that were affected, and is buying the rest on the market and over the counter. Deposits were unaffected, but withdrawals were suspended and are expected to resume within a day or two. Binance also plans to publish an updated Proof of Reserves. Reuters, citing a person familiar with the matter, reported that the exchange is working with the FBI and the US Secret Service.

A familiar playbook, and a market under strain

TRM said several features of the attack match earlier North Korea-linked heists. It specifically cited the $1.5 billion Bybit theft in 2025, which the FBI attributed to North Korea and TraderTraitor. Experts say Pyongyang has turned to crypto theft as a source of foreign currency for its economy and nuclear program after heavy UN sanctions. South Korea’s spy agency estimated in 2022 that North Korean hackers had stolen about $1.1 billion in digital assets over five years.

Markets took the news badly. Bitcoin fell more than 3 percent to a six-week low near $76,400. Ether dropped to a two-month low around $2,178, and BNB, the exchange’s own token, slid about 5 percent. Total crypto liquidations reached $1.5 billion, mostly from traders betting on higher prices. Coinbase shares fell 4.8 percent and Strategy shares nearly 6 percent in extended US trading.

Analysts see consequences beyond the price drop. Moody’s Ratings’ Cristiano Ventricelli said the Binance hack shows the risk of hot wallets and of concentrating assets in large centralized intermediaries. Bernardo Brites of Trace Finance expects users to drift away from smaller exchanges that could not absorb a loss on this scale. Standard Chartered’s Geoffrey Kendrick suggested more downside may come before prices settle. He also argued the episode could speed a shift toward decentralized exchanges.

Binance, which has 335 million registered users and held about $162.8 billion in custody at the end of 2025, says user funds remain safe. Chainalysis has warned that scammers are posing as the firm to offer fund recovery services, so victims should use official channels only. Key open questions are whether the frozen assets can be returned, how the attacker got in, and whether governments will formally back the North Korea attribution.

Explore more on this topic with Vexel Search.