Chainalysis and TRM Labs linked a $6.3 billion hack at Binance to TraderTraitor, a unit associated with North Korea. Chainalysis assessed the total at $6.4 billion. Funds began leaving Binance hot wallets across multiple blockchains around 4:20 p.m. Eastern Time on October 29.
The attacker used an operational wallet funded through Tornado Cash to submit signed authorizations that allowed a Binance hot wallet to run attacker-deployed code. Binance said its initial investigation points to a compromised engineer's laptop, which gave the attacker access to a service container and enabled unauthorized withdrawals. Binance found no evidence of a wallet private key leak.
The attacker converted stablecoins into ether and other assets that issuers cannot freeze. Chainalysis said the attacker swapped $325 million in stablecoins into $285 million in ETH over roughly 20 minutes, then sent the remaining $175 million to stopover wallets. Freezes began by 5:14 p.m. Eastern.
Bitcoin dropped toward $76,000 before trading near $77,400. Total market liquidations reached $1.5 billion, with bitcoin accounting for $468 million and ether for $358 million. Long positions bore most of the losses.
Stablecoin issuers moved to contain the fallout. Tether froze more than $1.567 billion in USDT. Circle froze more than $800 million in USDC in coordination with law enforcement. First Digital froze stolen FDUSD. Binance said about $3 billion has been frozen onchain in total.
Binance reserved more than $6.34 billion of company funds to cover the incident. About $5 billion of that reserve is held in the same token assets that were affected. Reuters reported that Binance is working with the FBI and the U.S. Secret Service.
Former CEO Changpeng Zhao wrote on X, "It does look like a hack." The hack would be the largest crypto hack on record if confirmed at this scale, surpassing the $1.5 billion Bybit hack of 2025.