A $6.3 billion theft from Binance has been linked by blockchain analysis firms to TraderTraitor, a group associated with North Korea, in what could become the largest cryptocurrency hack on record. The incident triggered a broad market sell-off, the freezing of billions of dollars in assets and renewed scrutiny of exchange security.
According to Bitcoin Magazine, Chainalysis and TRM Labs connected the attack to TraderTraitor, while Chainalysis estimated the total value stolen at $6.4 billion. Binance said its initial investigation indicated that an engineer’s compromised laptop gave the attacker access to a service container and allowed unauthorized withdrawals.
How the attack unfolded
Chainalysis said funds began leaving Binance hot wallets across several blockchains at about 4:20 p.m. Eastern Time on October 29. Hot wallets are online cryptocurrency wallets used to facilitate transactions, making them operationally important but also exposed to digital attacks.
The attacker reportedly used an operational wallet funded through Tornado Cash to submit signed authorizations. Those authorizations allowed a Binance hot wallet to execute code deployed by the attacker, after which assets were transferred to addresses under the attacker’s control.
Binance said it had found no evidence that a wallet private key had been leaked. Instead, its preliminary account points to the compromised laptop and the attacker’s access to a service container as the route used to initiate the withdrawals.
The stolen assets were then rapidly rearranged. Chainalysis said about $325 million in stablecoins was exchanged for roughly $285 million in ether over approximately 20 minutes. Stablecoins are digital tokens designed to track the value of traditional currencies, while ether is the native asset of the Ethereum network. Unlike many stablecoins, ether cannot be frozen by a token issuer.
The attacker also sent a further $175 million to stopover wallets, according to Chainalysis. Issuers and other parties began freezing assets by 5:14 p.m. Eastern Time, in an effort to limit the amount that could be moved or converted.
If the reported scale is confirmed, the theft would surpass the $1.5 billion Bybit hack in 2025, which was also attributed to North Korean hackers. Former Binance chief executive Changpeng Zhao, who remains a key shareholder but no longer runs the exchange, wrote on X that the incident “does look like a hack.”
Issuers freeze billions as markets retreat
Stablecoin companies moved to contain the stolen funds. Tether chief executive Paolo Ardoino said the company froze more than $1.567 billion in USDT. Circle co-founder and chief executive Jeremy Allaire said Circle froze more than $800 million in USDC in coordination with law enforcement. First Digital chief executive Vincent Chok said stolen FDUSD had also been frozen.
Binance said approximately $3 billion had been frozen onchain in total. The exchange said it was working with the FBI and the U.S. Secret Service, according to Reuters, which cited a person familiar with the matter.
The incident added pressure to an already weak cryptocurrency market. Bitcoin fell toward $76,000 on Friday morning before trading near $77,400, while other major cryptocurrencies also declined. Total liquidations reached $1.5 billion, including $468 million in bitcoin and $358 million in ether. Long positions, which are designed to benefit from rising prices, accounted for most of the losses.
The market move coincided with a separate security incident at decentralized betting platform Polymarket. The platform suspended international trading after hackers drained more than $2.6 million from user accounts.
Binance says reserves can cover the loss
Binance said it had more than $6.34 billion in company funds reserved to cover the incident. Roughly $5 billion of that amount is held in the same token assets affected by the attack, while the exchange said it was acquiring the balance through market transactions and over-the-counter channels.
The company added that frozen and protected assets still require verification. It plans to publish an updated Proof of Reserves, a report intended to show the assets held by an exchange and support claims about its ability to meet obligations.
The scale of the event has also raised questions about how cryptocurrency platforms protect operational systems that can authorize withdrawals. Standard Chartered’s global head of digital assets research, Geoffrey Kendrick, told CoinDesk in an email that the negative price action could continue before a new market base forms. He said the market may need to see assets unfrozen and more details of the attack before conditions stabilize.
Kendrick also said the incident could accelerate interest in decentralized exchanges. Meanwhile, Chainalysis warned that scammers were impersonating the company with fake fund-recovery and recruitment offers. People affected by the hack were urged to treat unsolicited recovery services cautiously and use official channels for updates.
Current market picture
Moneyiar market data at 12:58-12:59 p.m. on November 1, 2026, showed bitcoin at $77,777.80, up 0.47% over 24 hours but down 3.20% over seven days. BNB was $712.08, up 0.99% in 24 hours and down 3.62% over seven days.
Chainlink stood at $11.64, up 0.48% over 24 hours and 2.35% over seven days. Billions Network was $0.0140, down 0.59% over 24 hours and up 10.04% over seven days. These figures are Moneyiar data at the stated time and reflect market prices after the reported hack.
