Blockchain analysis firms Chainalysis and TRM Labs linked a $6.3 billion hack at Binance to TraderTraitor, a unit associated with North Korea. Chainalysis assessed the total at $6.4 billion. Funds began leaving Binance hot wallets across multiple blockchains around 4:20 p.m. Eastern Time on October 29. The attacker used an operational wallet funded through Tornado Cash to submit signed authorizations that allowed a Binance hot wallet to run attacker-deployed code, then swept assets into addresses under its control.
Binance said its initial investigation points to a compromised engineer's laptop that gave the attacker access to a service container and enabled unauthorized withdrawals. The exchange found no evidence of a wallet private key leak. The attacker converted $325 million in stablecoins into $285 million in ether over roughly 20 minutes, then sent the remaining $175 million to stopover wallets. Chainalysis said freezes began by 5:14 p.m. Eastern.
Bitcoin dropped toward $76,000 on Friday morning before trading near $77,400. Total market liquidations reached $1.5 billion, with bitcoin accounting for $468 million and ether for $358 million. Long positions bore most of the losses.
Tether CEO Paolo Ardoino said the company froze more than $1.567 billion in USDT. Circle co-founder and CEO Jeremy Allaire said Circle froze more than $800 million in USDC in coordination with law enforcement. First Digital CEO Vincent Chok said FDUSD stolen in the attack has been frozen. Binance said about $3 billion has been frozen onchain in total.
Binance reserved more than $6.34 billion of company funds to cover the incident. About $5 billion of that reserve is held in the same token assets that were affected, and the company is buying the remainder through market and OTC channels. Reuters, citing a person familiar with the matter, reported that Binance is working with the FBI and the U.S. Secret Service.
Standard Chartered's global head of digital assets research, Geoffrey Kendrick, said the negative price action may have some way to go and that a new base will form after assets are unfrozen and more details emerge. Kendrick argued the incident could accelerate a shift toward decentralized exchanges. Chainalysis warned that scammers are impersonating the firm, offering fund recovery and recruiting services.