Chainalysis and TRM Blame North Korea for $6.4B Binance Hack

Two blockchain analytics firms, Chainalysis and TRM Labs, have each pinned the October 29 Binance hack on TraderTraitor, a North Korean hacking unit. Chainalysis puts the unauthorized transfers at about $6.4 billion and calls it "the largest theft in crypto history." TRM Labs counts about $6.36 billion, roughly four times the $1.5 billion Bybit hack of February 2025.

For holders, the number that matters is how much of the money can still be stopped. Chainalysis says about $2.8 billion has been frozen. TRM puts the figure at about $2.7 billion, frozen by Tether, Circle, Ripple, WLF and the Arbitrum Security Council. The rest is harder to reach. TRM says the attacker now holds "more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion in assets beyond any issuer's reach."

How Chainalysis and TRM Reached the Same Name

Chainalysis based its call on the money trail. Stolen Binance funds mixed on-chain with funds from last month's Bitget theft, which had already been attributed to North Korea. "That direct on-chain link strengthened our assessment that TraderTraitor carried out the Binance hack," the firm wrote. It announced the attribution at 12:30 a.m. Eastern on October 30.

TRM reached the same conclusion "based on robust on and off-chain intelligence" and said it makes that judgment "with high confidence." It pointed to signatures it has seen before in the Bybit and KelpDAO attacks:

• small Tornado Cash withdrawals funding an operator wallet
• staging that began well before the theft
• signatures obtained in advance, then executed in one burst

These are private firms, not governments. TRM's October 30 post noted that "no government has attributed the theft" at that point. A reported FBI attribution on Saturday has not been confirmed against an FBI statement. The same TRM post said Binance had not published a root cause.

How the Attacker Got Into Binance Hot Wallets

Chainalysis says funds began leaving Binance hot wallets, the exchange's internet-connected wallets for day-to-day withdrawals, across multiple blockchains around 4:20 p.m. ET. TRM dates the start to 20:05 UTC and says most of the money moved in about 20 minutes, across ten blockchains.

On Ethereum, the attacker used a wallet funded through Tornado Cash to submit valid signed authorizations. These let a Binance hot wallet run code the attacker had deployed. TRM says the method was an EIP-7702 delegation, an Ethereum feature that lets an ordinary wallet run smart contract code. It turned the hot wallet into a sweeper the attacker controlled, using 50 pre-signed authorizations prepared in advance. TRM assesses that Binance's hot wallet signing infrastructure was compromised.

The attacker then swapped $325 million in stablecoins into $285 million in ETH over nearly 20 minutes. Stablecoin issuers can freeze tokens; nobody can freeze ETH in the same way. TRM's breakdown of the outflows by chain:

• Ethereum: about $3.79 billion
• Bitcoin: 18,270 BTC, about $1.47 billion
• Tron: 612.7 million USDT and 46.4 million TRX, about $628 million
• XRP Ledger: 233.46 million XRP, about $296 million
• Solana: 970,500 SOL, about $96 million

Chainalysis says the laundering shows signs of automation: thousands of transactions, with many addresses first receiving exactly 1 TRX, then more funds, then forwarding them on.

North Korea's 2026 Tally Depends on Who Counts

On TRM's count, North Korea has stolen about $12.8 billion in crypto across 100 incidents since 2017, with $7.4 billion of it in 2026. That makes North Korea responsible for 85% of all crypto hack value this year, up from 7% in 2020. Total hacking losses for 2026 have reached $8.7 billion, the highest on record.

TRM's data also shows where the money comes from. Five hacks (Binance, Bybit, Ronin, Bitget and DMM Bitcoin) account for $9.1 billion of the $12.8 billion. Only 13 of the 100 incidents were code exploits, adding up to about 1% of the total. Including Binance, 88% of the stolen value came from attacks on infrastructure such as wallets and signing systems, up from about 76% before.

Chainalysis has not published a 2026 tally that includes Binance. Its last update came after the $387 million Bitget theft on September 24, which pushed North Korea's 2026 total past $1 billion. For 2025, Chainalysis counted at least $2.02 billion stolen, up 51% from 2024, bringing its lower-bound all-time estimate to $6.75 billion.

The two firms use different methods, so their totals do not line up. But on Chainalysis's own numbers, the single Binance theft is nearly as large as everything it had counted North Korea stealing from crypto through the end of 2025.

The open questions now are Binance's own root cause, which had not been published as of TRM's October 30 post, and the roughly $2.4 billion in ETH and BTC that no issuer can freeze.