Chainalysis and TRM Labs Link $6.3B Binance Hack to North Korea's TraderTraitor
Blockchain analysis firms Chainalysis and TRM Labs attributed the $6.3 billion Binance hack to North Korea's TraderTraitor group. Binance has reserved more than $6.34 billion to cover the incident, and stablecoin issuers have frozen billions in stolen funds.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Reporting: Bitcoin Magazine — this story is based on a single source so far.
Story Updates
- Updated Oct 30, 2026, 04:01 PM: TRM Labs and Chainalysis attribute the hack to North Korea's TraderTraitor and report on-chain laundering and EIP-7702 use.
Attribution and Scale
Chainalysis and TRM Labs have both attributed the Binance hack to TraderTraitor, a North Korean hacking group. TRM Labs said it reached the attribution "with high confidence" based on "robust on and off-chain intelligence," and put the theft at about $6.36 billion. Chainalysis put the total at about $6.4 billion. Both firms describe it as the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025, which the FBI attributed to the same group.
Chainalysis said its strongest evidence came when investigators saw funds stolen from Binance commingling in real time with proceeds from last month's Bitget exploit, which had also been linked to North Korean actors. Singapore-based Pangolin Intelligence told CNN it reached a similar conclusion. North Korea has previously denied hacking allegations.
How the Attack Unfolded
According to TRM Labs, funds left Binance wallets across 10 blockchains, most of them within about 20 minutes starting at 4:05 p.m. Eastern Time on Thursday. Chainalysis said the attacker's operational wallet was funded through the Tornado Cash mixer, and TRM said that feature and staging that began well before the theft matched earlier North Korea-linked attacks, including the Bybit hack and April's KelpDAO exploit.
On Ethereum, TRM said the attacker used an EIP-7702 delegation, a feature introduced in the Pectra upgrade that lets an ordinary wallet run smart contract code, to turn a Binance hot wallet into a sweeper it controlled. It prepared 50 pre-signed authorizations in advance. Wallets on the other nine chains sent funds through ordinary signed transfers. TRM concluded this points to a compromise of Binance's hot wallet signing infrastructure.
Binance said its investigation began with a compromised engineer's laptop but has since uncovered "additional points of breach." Earlier reporting had said the exchange found no evidence of a private key leak; that statement should now be read alongside the newer finding.
Laundering and Stablecoin Freezes
Chainalysis said it is seeing "never-seen-before laundering patterns," with thousands of transactions in a short period suggesting automation used to circulate funds among addresses. TRM said the attacker sold USDT to market makers and borrowed ETH against USDT on the Aave lending protocol to race issuer freezes. TRM estimates the attacker now holds more than 420,000 ETH and 18,270 BTC, roughly $2 billion.
Stablecoin issuers moved to contain the fallout. Tether CEO Paolo Ardoino said the company froze more than $1.567 billion in USDT. Circle CEO Jeremy Allaire said Circle froze more than $800 million in USDC in coordination with law enforcement. First Digital CEO Vincent Chok said stolen FDUSD has been frozen. Binance says about $3 billion has been frozen onchain in total.
Binance says it has reserved more than $6.34 billion of company funds to cover the incident. About $5 billion of that reserve is held in the affected token assets, with the remainder being bought through market and OTC channels. Frozen and protected assets remain subject to verification, and the exchange plans to publish an updated Proof of Reserves.
Market Reaction
Bitcoin dropped toward $76,000 on Friday morning before trading near $77,400. Total market liquidations reached $1.5 billion, with bitcoin accounting for $468 million and ether for $358 million. Long positions bore most of the losses. The sell-off coincided with a separate incident at decentralized betting platform Polymarket, which suspended international trading after hackers drained more than $2.6 million from user accounts.
Standard Chartered's Geoffrey Kendrick told CoinDesk the negative price action may have further to run, and that a new base would form after assets are unfrozen and more details emerge. He argued the incident could accelerate a shift toward decentralized exchanges.
Law Enforcement and Warnings
Reuters, citing a person familiar with the matter, reported that Binance is working with the FBI and the U.S. Secret Service. Former CEO Changpeng Zhao, who remains a key shareholder, wrote on X, "It does look like a hack."
Chainalysis has warned that scammers are impersonating the firm, including those offering fund recovery and recruitment services. Victims should treat unsolicited recovery offers with caution and rely on official channels for updates.
Why It Matters
For Traders
Ongoing liquidations and the attacker's roughly $2 billion in unlaundered holdings make near-term price action fragile until freezes and asset verification progress.
For Investors
Attribution to a state-linked group and a loss roughly four times Bybit's raise lasting questions about exchange custody, reserves, and sanctions exposure.
For Builders
The EIP-7702 delegation abuse and pre-signed authorizations show that hot wallet signing infrastructure and smart-account features need hardened permission reviews.
This article is for information only and is not financial advice. Read the full disclaimer.
