Binance hack: TRM and Chainalysis tie the $6.4bn theft to North Korea

Two blockchain analytics firms now name the same attacker behind the Binance hack. TRM Labs attributes the theft of about $6.36 billion to TraderTraitor, the North Korean group the FBI blamed for the $1.5 billion Bybit hack in February 2025, "with high confidence." Chainalysis puts the theft at about $6.4 billion and reaches the same conclusion, Decrypt reported on 30 October. North Korea has denied earlier hacking accusations.

The evidence

Chainalysis's strongest point is money moving together. It watched stolen Binance funds mix in real time with proceeds of the Bitget exploit, which investigators had already linked to North Korean actors. TRM adds two more traits: the attacker's operational wallet was funded through Tornado Cash, and the staging started well before the theft. Both match the Bybit hack and the KelpDAO exploit in April.

Singapore-based Pangolin Intelligence told CNN it reached the same view from on-chain analysis. Elliptic is more cautious about Binance hack attribution: the overlap with Bitget funds is small, about $39,000, and no government has named the attacker yet.

How the money left

On Ethereum the attacker used an EIP-7702 delegation, a feature added in the Pectra upgrade, to turn a Binance hot wallet into a sweeper with 50 authorizations signed in advance. On the other nine chains, Binance wallets sent funds through ordinary signed transfers. TRM reads that as a compromise of Binance's hot wallet signing system. Binance says the breach began on an engineer's laptop and that it has since found "additional points of breach." The Bybit attack also started on one compromised machine.

Most of the money left in about 20 minutes from 20:05 UTC on 29 October, across 10 blockchains by TRM's count. Chainalysis describes "never-seen-before laundering patterns": thousands of transactions in a short window, which points to automation. Per TRM, the attacker sold USDT to market makers and borrowed ETH against USDT on Aave to move ahead of issuer freezes.

“We will weather this storm”

— Binance, 30 October 2026, as quoted by Decrypt · decrypt.co

What Binance is doing

Binance says it has set aside more than $6.34 billion of company funds to cover users. About $5 billion of that already sits in the same tokens that were stolen, and Binance is buying the rest on the market and through OTC desks. Tether, Circle, Ripple and World Liberty Financial have frozen about $2.67 billion in stablecoins, and the Arbitrum Security Council locked 8,426 ETH and 74.6 million ARB. Binance puts the total frozen at about $3 billion.

The day before the hack, the US Treasury sanctioned 10 people and one entity over North Korean IT worker schemes that moved millions in crypto. In August 2025, Binance security chief Jimmy Su told Decrypt that North Korean operatives try to get hired at Binance every day.

Our count

• The attacker still holds about 420,000 ETH and 18,270 BTC. At Friday morning prices that is roughly $0.93 billion in ether and $1.4 billion in bitcoin, close to TRM's $2.4 billion beyond any issuer's reach.
• Binance's $6.34 billion reserve covers 99% of Chainalysis's $6.4 billion estimate.
• 79% of that reserve was already held in the stolen tokens, so Binance has to buy only about $1.3 billion in the market.
• The theft is about four times the Bybit record.

If you hold funds on any large exchange, the pattern to watch is the one TRM describes: a single engineer's machine, then the signing system. Ask your exchange whether its hot wallet withdrawals need sign-off from separate devices.

This news is for information and is not investment advice. Attribution comes from TRM Labs and Chainalysis as reported by Decrypt; North Korea has denied earlier accusations, and no government has confirmed the attribution.