North Korea took $6.36 billion from Binance and $2.4 billion is beyond any freeze
TRM Labs' overnight onchain map pinned the largest crypto theft in history on North Korea's TraderTraitor. Issuers froze about $2.7 billion; the attacker had already turned the rest into ETH and BTC no issuer can touch, a traced $2.4 billion that now has to find a buyer.
Vincent Jiang · 4 min read
Twenty minutes, ten chains, $6.36 billion
At 20:05 UTC on October 29 an attacker began moving about $6.36 billion out of Binance wallets on ten blockchains, most of it inside 20 minutes 1. It is the largest crypto theft on record, roughly four times the $1.5 billion Bybit hack of February 2025, which the FBI pinned on the same unit 1.
The Binance theft is roughly four times the previous record
Data
| Value | |
|---|---|
| Binance, Oct 2026 | $6.36B |
| Bybit, Feb 2025 | $1.5B |
| Bitget, Sep 2026 | $0.39B |
TRM Labs, the San Francisco blockchain-intelligence firm, attributes the attack to TraderTraitor, North Korea's elite hacking unit, with high confidence 1. Chainalysis reached the same verdict independently: "We have a high degree of confidence that DPRK is responsible," it said, citing commingling with September's $388 million Bitget theft that investigator ZachXBT traced to a single Ethereum address 29.
The freeze race the attacker had already won
Preparation began at least 36 hours out, funded by small withdrawals from Tornado Cash, a service that obscures where crypto comes from, and rehearsed on test wallets the day before 1. On the night, 50 pre-signed Ethereum authorizations turned one of Binance's best-known hot wallets, the internet-connected wallets an exchange uses to pay customer withdrawals, into a sweeper the operator controlled, while wallets on nine other chains signed ordinary transfers 1.
Ten key types and signing schemes produced valid signatures inside about half an hour, which in TRM's assessment points to a compromise of Binance's signing infrastructure rather than one phished key 1.
$2.7 billion frozen, $2.4 billion already untouchable
The freezes still landed, about $2.7 billion in all: Tether froze 1.77 billion USDT, Circle about 825 million USDC, Ripple 40.5 million RLUSD and World Liberty Financial 27.8 million USD1, with Arbitrum's Security Council seizing about $30 million more 1. The attacker had already raced them, selling about $325 million of USDT for roughly 122,300 ETH at a more than 10% discount and borrowing another 19,760 ETH on Aave, a lending protocol 1. It now holds over 420,000 ETH and 18,270 BTC, about $2.4 billion no issuer can touch 1.
Tether and Circle froze about 96% of the $2.7 billion
- Tether$1,770M65.8%
- Circle$825M30.6%
- Ripple$40.5M1.5%
- Arbitrum$30M1.1%
- World Liberty Financial$27.8M1%
Data
| Slice | Value | Share |
|---|---|---|
| Tether | $1,770M | 65.8% |
| Circle | $825M | 30.6% |
| Ripple | $40.5M | 1.5% |
| Arbitrum | $30M | 1.1% |
| World Liberty Financial | $27.8M | 1% |
Who pays
Binance says it will cover all losses from its Secure Asset Fund for Users (SAFU), about 15,000 BTC, plus company funds, and expects withdrawals back within about 48 hours 378. Its first account blamed a compromised DevOps engineer's laptop; chief executive Richard Teng now calls the attack more complex, and no individual has been blamed 78.
A traced $2.4 billion has to find a buyer
The bill does not stop at Binance. A traced holder of $2.4 billion in ETH and BTC cannot sell at a screened exchange, so whenever it cashes out it must work through cross-chain bridges, swap services and over-the-counter desks, the channels TRM expects for the next stage 1.
Freezes caught $2.7 billion; $2.4 billion is already beyond any issuer
Data
| Value | |
|---|---|
| Moved from Binance wallets | $6.36B |
| Frozen by issuers and Arbitrum | $2.7B |
| Beyond any issuer's reach | $2.4B |
Known inventory that must find a buyer is an overhang on ETH, BTC and the equities that track them, and Friday's premarket priced it in: Coinbase down 5.2%, Strategy, the largest corporate holder of bitcoin, down 5.1%, and bitcoin below $77,000, its lowest in more than a month 34. Standard Chartered's Geoffrey Kendrick expects the selling to run further 4.
The vendors collect on the far side
The screening vendors are positioned to collect on the far side of this trade, and their week was already full: TRM's research traced payments to Virtualine, a hosting provider whose domain the FBI seized on October 27, and the Treasury's Office of Foreign Assets Control (OFAC) sanctioned ten North Korean IT workers the next day 56. TRM is private, valued at $2 billion in a September funding round, so there is no vendor stock to buy; the trade sits in the assets its map reprices 11.
The recovery will be slower than the freeze
A freeze stops the money moving, and recovery follows through legal process, as TRM policy chief Ari Redbord put it: stablecoins are the most recoverable asset in crypto because the issuer controls the token contract, while bitcoin and ether have no issuer to freeze them 10. Chainalysis expects returns to take months or years 10. Fundstrat's Sean Farrell sees no meaningful solvency risk for Binance, and names the tell: how quickly withdrawals resume, and whether outflows stay orderly 10.
The 18,270 BTC sits split into 19 fresh addresses, 17 holding exactly 1,000 BTC, none of it yet at an exchange, bridge or mixer 7. The technique is a peel chain, successive small transfers meant to shake trackers 1. Its first deposit at a screened exchange is the next tell.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
