---
title: "North Korea took $6.36 billion from Binance and $2.4 billion is beyond any freeze"
description: "TRM Labs' overnight onchain map pinned the largest crypto theft in history on North Korea's TraderTraitor. Issuers froze about $2.7 billion; the attacker had already turned the rest into ETH and BTC no issuer can touch, a traced $2.4 billion that now has to find a buyer."
publisher: "The Inference"
section: "Security"
published: 2026-10-30T16:13:28.923Z
modified: 2026-10-30T16:13:28.923Z
canonical: https://theinference.org/article/north-korea-took-6-36-billion-from-binance-and-2-4-billion-is-beyond-any-freeze
language: en
keywords: "Security, Crypto, Binance, North Korea, Stablecoins, Bitcoin"
---

# North Korea took $6.36 billion from Binance and $2.4 billion is beyond any freeze

> TRM Labs' overnight onchain map pinned the largest crypto theft in history on North Korea's TraderTraitor. Issuers froze about $2.7 billion; the attacker had already turned the rest into ETH and BTC no issuer can touch, a traced $2.4 billion that now has to find a buyer.

## Twenty minutes, ten chains, $6.36 billion

At 20:05 UTC on October 29 an attacker began moving about $6.36 billion out of [Binance](https://theinference.org/markets/companies/binance) wallets on ten blockchains, most of it inside 20 minutes [1]. It is [the largest crypto theft on record](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history), roughly four times the $1.5 billion Bybit hack of February 2025, which the FBI pinned on the same unit [1].

*Chart: **The Binance theft is roughly four times the previous record** Bar chart of the largest crypto thefts on record: the $6.36 billion Binance theft of October 2026, the $1.5 billion Bybit theft of February 2025 and the $388 million Bitget theft of September 2026*

*USD billions, valued at the time of each theft. Binance count per TRM Labs, October 30, 2026; Bybit and Bitget per the attributions TRM and Chainalysis cite. [1][2][9]*

[TRM Labs](https://theinference.org/markets/companies/trm-labs), the San Francisco blockchain-intelligence firm, attributes the attack to TraderTraitor, North Korea's elite hacking unit, with high confidence [1]. Chainalysis reached the same verdict independently: "[We have a high degree of confidence that DPRK is responsible](https://coingape.com/binance-hack-update-chainalysis-trm-labs-others-blame-north-korea-for-biggest-crypto-theft/)," it said, citing commingling with [September's $388 million Bitget theft](https://theinference.org/article/trm-s-feed-turned-away-50-million-of-bitget-s-stolen-money-and-its-counts-just-entered-ofac-s-designations) that investigator ZachXBT traced to a single Ethereum address [2][9].

## The freeze race the attacker had already won

Preparation began at least 36 hours out, funded by small withdrawals from Tornado Cash, a service that obscures where crypto comes from, and rehearsed on test wallets the day before [1]. On the night, 50 pre-signed Ethereum authorizations turned one of Binance's best-known hot wallets, the internet-connected wallets an exchange uses to pay customer withdrawals, into a sweeper the operator controlled, while wallets on nine other chains signed ordinary transfers [1].

Ten key types and signing schemes produced valid signatures inside about half an hour, which in TRM's assessment points to a compromise of Binance's signing infrastructure rather than one phished key [1].

## $2.7 billion frozen, $2.4 billion already untouchable

The freezes still landed, about $2.7 billion in all: [Tether](https://theinference.org/markets/companies/tether) froze 1.77 billion USDT, Circle about 825 million USDC, Ripple 40.5 million RLUSD and [World Liberty Financial 27.8 million USD1](https://theinference.org/article/circle-shareholder-sues-trump-over-2-5-billion-of-uae-money-behind-stablecoin-rival-usd1), with Arbitrum's Security Council seizing about $30 million more [1]. The attacker had already raced them, selling about $325 million of USDT for roughly 122,300 ETH at a more than 10% discount and borrowing another 19,760 ETH on Aave, a lending protocol [1]. It now holds over 420,000 ETH and 18,270 BTC, about $2.4 billion no issuer can touch [1].

*Chart: **Tether and Circle froze about 96% of the $2.7 billion** Pie chart of the roughly $2.7 billion frozen after the Binance hack: Tether 1.77 billion USDT, Circle about 825 million USDC, Ripple 40.5 million RLUSD, Arbitrum's Security Council about 30 million and World Liberty Financial 27.8 million USD1*

*USD millions frozen by issuer and by Arbitrum's Security Council, per TRM Labs as of October 30, 2026. [1]*

## Who pays

Binance says it will cover all losses from its Secure Asset Fund for Users (SAFU), about 15,000 BTC, plus company funds, and expects withdrawals back within about 48 hours [3][7][8]. Its first account [blamed a compromised DevOps engineer's laptop](https://www.forbes.com/sites/digital-assets/2026/10/30/binances-63-billion-hack-started-with-one-engineers-laptop/); chief executive Richard Teng now calls the attack more complex, and no individual has been blamed [7][8].

## A traced $2.4 billion has to find a buyer

The bill does not stop at Binance. A traced holder of $2.4 billion in ETH and BTC cannot sell at a screened exchange, so whenever it cashes out it must work through cross-chain bridges, swap services and over-the-counter desks, the channels TRM expects for the next stage [1].

*Chart: **Freezes caught $2.7 billion; $2.4 billion is already beyond any issuer** Bars comparing the $6.36 billion moved from Binance wallets, the $2.7 billion frozen by issuers and Arbitrum, and the $2.4 billion beyond any issuer's reach*

*USD billions, each transfer valued at the moment it was taken; TRM Labs onchain count as of October 30, 2026, 00:30 UTC. [1]*

Known inventory that must find a buyer is an overhang on ETH, BTC and the equities that track them, and Friday's premarket priced it in: [Coinbase](https://theinference.org/article/coinbase-says-891-billion-of-stablecoins-moved-in-q3-on-a-flat-301-billion-float-as-a-senate-clause-looms) down 5.2%, Strategy, the largest corporate holder of bitcoin, down 5.1%, and bitcoin below $77,000, its lowest in more than a month [3][4]. Standard Chartered's Geoffrey Kendrick [expects the selling to run further](https://finance.yahoo.com/markets/crypto/articles/crypto-stocks-drop-record-6-103416583.html) [4].

## The vendors collect on the far side

The screening vendors are positioned to collect on the far side of this trade, and their week was already full: TRM's research traced payments to Virtualine, a hosting provider [whose domain the FBI seized on October 27](https://ambcrypto.com/fbi-seizes-virtualine-domain-as-trm-traces-criminal-crypto-payments/), and the Treasury's Office of Foreign Assets Control (OFAC) [sanctioned ten North Korean IT workers](https://tozvan.com/enforcement/ofac-it-worker-sanctions) the next day [5][6]. TRM is private, valued at $2 billion in a September funding round, so there is no vendor stock to buy; the trade sits in the assets its map reprices [11].

## The recovery will be slower than the freeze

A freeze stops the money moving, and recovery follows through legal process, as TRM policy chief Ari Redbord put it: stablecoins are the most recoverable asset in crypto because the issuer controls the token contract, while bitcoin and ether have no issuer to freeze them [10]. [Chainalysis expects returns to take months or years](https://www.msn.com/en-us/money/markets/billions-in-crypto-frozen-in-binance-hack-heres-what-happens-next/ar-AA2gni45) [10]. Fundstrat's Sean Farrell sees no meaningful solvency risk for Binance, and names the tell: how quickly withdrawals resume, and whether outflows stay orderly [10].

The 18,270 BTC sits split into 19 fresh addresses, 17 holding exactly 1,000 BTC, none of it yet at an exchange, bridge or mixer [7]. The technique is a peel chain, successive small transfers meant to shake trackers [1]. Its first deposit at a screened exchange is the next tell.

## Takeaway

Issuers froze $2.7 billion of North Korea's $6.36 billion Binance theft, but $2.4 billion already sits in ETH and BTC no issuer can touch. The tells ahead: Binance's 48-hour withdrawal restart and the stolen coins' first deposit at a screened exchange.

## Sources

1. [TRM Labs, North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History, 30 October 2026](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history)
2. [CoinGape, Binance Hack Update: Chainalysis, TRM Labs, Others Blame North Korea for Biggest Crypto Theft, 30 October 2026](https://coingape.com/binance-hack-update-chainalysis-trm-labs-others-blame-north-korea-for-biggest-crypto-theft/)
3. [УНН (UNN), Bitcoin fell amid a $6.3 billion hack of Binance, with the attack attributed to North Korean hackers, 30 October 2026](https://unn.ua/en/news/bitcoin-fell-amid-a-dollar63-billion-hack-of-binance-with-the-attack-attributed-to-north-korean-hackers)
4. [Yahoo Finance (Investing.com), Crypto stocks drop after record $6.3bn Binance hack, 30 October 2026](https://finance.yahoo.com/markets/crypto/articles/crypto-stocks-drop-record-6-103416583.html)
5. [AMBCrypto, FBI seizes Virtualine domain as TRM traces criminal crypto payments, 29 October 2026](https://ambcrypto.com/fbi-seizes-virtualine-domain-as-trm-traces-criminal-crypto-payments/)
6. [Tozvan, OFAC imposes IT worker sanctions on 10 individuals, TRM Labs says, 28 October 2026](https://tozvan.com/enforcement/ofac-it-worker-sanctions)
7. [Forbes, Binance's $6.3 Billion Hack Started With One Engineer's Laptop, 30 October 2026](https://www.forbes.com/sites/digital-assets/2026/10/30/binances-63-billion-hack-started-with-one-engineers-laptop/)
8. [CryptoSlate, Binance uncovers more breach points in $6 billion hack, 30 October 2026](https://cryptoslate.com/binance-breach-points-6-billion-hack/)
9. [Cointelegraph, North Korea's TraderTraitor linked to $6.3B Binance hack, 29 October 2026](https://cointelegraph.com/news/north-korea-linked-to-63b-binance-hack-by-crypto-investigators)
10. [CNBC (via MSN), Binance's $6.3 billion hack: What we know and what comes next, 30 October 2026](https://www.msn.com/en-us/money/markets/billions-in-crypto-frozen-in-binance-hack-heres-what-happens-next/ar-AA2gni45)
11. [Cointelegraph, TRM Labs doubles valuation to $2B in Series C expansion, 9 September 2026](https://cointelegraph.com/news/trm-labs-doubles-valuation-to-2b-in-series-c-expansion)


---

North Korea took $6.36 billion from Binance and $2.4 billion is beyond any freeze — The Inference. Canonical: https://theinference.org/article/north-korea-took-6-36-billion-from-binance-and-2-4-billion-is-beyond-any-freeze