North Korea Stole $6.36B From Binance; About $2.7B Is Frozen

An attacker moved about $6.36 billion out of Binance wallets on ten blockchains on 29 October, most of it in roughly 20 minutes starting at 20:05 UTC, blockchain analytics firm TRM Labs found. The FBI has said North Korea was responsible for the theft of "more than $6 billion USD in virtual assets". TRM and Chainalysis both name the state-backed group TraderTraitor.

For anyone holding coins on Binance, the split that matters is this. Roughly $2.7 billion has been frozen by stablecoin issuers and one network's security council. About $2.4 billion sits in assets no issuer can freeze. How much of the shortfall Binance has covered, and whether withdrawals reopened on Sunday 1 November, is not yet confirmed.

What Left Binance, Chain by Chain

TRM values the haul at $6.36 billion at the time of theft. Chainalysis puts it at about $6.4 billion and calls it "the largest theft in crypto history". TRM says it is about four times the $1.5 billion Bybit hack.

TRM's breakdown:

How the Freezes Worked, and Where They Stopped

The large stablecoin share is why so much could be frozen. TRM says Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins. Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB on its network. TRM puts the total at roughly $2.7 billion as of 00:30 UTC on 30 October. Chainalysis gives a figure of about $2.8 billion.

Ripple's part was specific. Binance co-CEO Yi He said Ripple helped stop about $200 million from moving, and TRM confirmed a freeze of 40.5 million RLUSD on-chain.

The attacker moved fast to get ahead of those freezes. Chainalysis says it swapped $325 million in stablecoins into $285 million in ETH over nearly 20 minutes. TRM says a second attacker wallet supplied 60 million USDT to the lending protocol Aave and borrowed about 19,760 ETH against it, after which Aave froze the affected markets.

The result, per TRM: the attacker "now holds more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion in assets beyond any issuer's reach." ETH and BTC have no central issuer that can switch them off.

Binance Has Not Published a Root Cause

On Ethereum, Chainalysis says the attacker used a wallet funded through Tornado Cash to "submit valid signed authorizations that allowed a Binance hot wallet to run attacker-deployed code", then swept the assets. A hot wallet is an exchange wallet kept online for day-to-day withdrawals.

TRM says the mechanism was EIP-7702 delegation, an Ethereum feature that lets an ordinary wallet temporarily run smart contract code, using 50 pre-signed authorizations. "In TRM's assessment, this points to a compromise of Binance's hot wallet signing infrastructure." TRM also notes Binance has not published a root cause, so that remains an analyst's reading, not a confirmed finding.

The groundwork was laid early. TRM says preparation began at least 36 hours before the theft, with Tornado Cash withdrawals starting on 28 October.

The Money Is Moving, but Not All of It

Chainalysis describes an unusual laundering pattern: "Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence." It also found stolen Binance funds mixed on-chain with money from last month's Bitget theft, which was also attributed to North Korea.

Not every asset has moved. TRM says the 233.46 million XRP has stayed at one attacker address. The BTC is going through a peel chain, a series of transfers that each split off a small amount.

The FBI, working with the Secret Service and IRS Criminal Investigation, says it has seen TraderTraitor "converting stolen assets primarily into Ethereum (ETH)" and expects laundering through DeFi and instant swap services. It has asked THORNode operators, RPC providers, DeFi protocols and exchanges "to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets", and published a list of those addresses.

TRM expects the next stage to run through cross-chain bridges, swap services and over-the-counter brokers. Chainalysis says its investigation is ongoing and expects the stolen funds "to continue moving in the coming days." The roughly $2.4 billion in ETH and BTC is the part to watch: once it reaches a bridge or an OTC desk, the window to block it gets much smaller.