North Korean Hackers Linked to Record $6.3 Billion Binance Breach as Bitcoin Slides

Binance is dealing with what could become the largest cryptocurrency theft in history after approximately $6.3 billion in digital assets were moved from its wallets during a major security breach on October 29. Blockchain intelligence firms have linked the attack to North Korea's TraderTraitor hacking group, while the incident has sent shockwaves through the cryptocurrency market.

The attack affected wallets across multiple blockchain networks, with billions of dollars transferred to attacker-controlled addresses in a remarkably short period of time. Binance has temporarily suspended withdrawals on affected networks, partnered with blockchain analytics companies to trace the stolen assets, and promised to cover all customer losses.

By October 30, Binance said approximately $3 billion in assets had been frozen. However, a significant amount remains under the attacker's control, leaving investigators and industry participants working to determine how the breach happened and whether additional funds can be recovered.

A Record-Breaking Attack Targets Binance

According to blockchain intelligence firm TRM Labs, approximately $6.36 billion was transferred from Binance wallets across ten different blockchain networks. Most of the funds moved within roughly 20 minutes, beginning around 20:05 UTC on October 29.

The affected networks included Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon.

TRM estimates that the incident is approximately four times larger than the $1.5 billion Bybit hack in February 2025, which was also attributed to North Korean hackers. If the current estimates hold, the Binance incident would represent the largest cryptocurrency theft on record.

The attack involved more than a simple unauthorized withdrawal. TRM's investigation found that the attacker prepared code and tested its operation before executing the transfers. On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper controlled by the attacker.

The technique allowed the attacker to use pre-signed authorizations to execute transactions through the compromised wallet. On other networks, funds were moved through ordinary signed transfers.

The speed and coordination of the transfers suggest a carefully prepared operation rather than an opportunistic attack.

North Korea's TraderTraitor Group Suspected

TRM Labs has attributed the attack to TraderTraitor, a North Korean hacking unit known for targeting cryptocurrency exchanges and blockchain companies.

The firm says its attribution is based on both on-chain and off-chain intelligence, and it describes its assessment as high confidence. Another blockchain intelligence company, Chainalysis, has also linked the incident to North Korean actors.

TraderTraitor has been associated with several major cryptocurrency thefts. The group was previously linked to the $1.5 billion Bybit attack in 2025, which demonstrated how sophisticated operations can target the infrastructure behind major cryptocurrency platforms.

North Korea has repeatedly been accused by international investigators of using cybercrime to generate revenue for the country. Cryptocurrency exchanges and decentralized finance platforms have become particularly attractive targets because large amounts of digital assets can be moved across borders without relying on traditional banking systems.

The Binance incident is another example of the scale of financial damage that sophisticated state-linked hacking operations can potentially cause.

Artificial intelligence has also become a growing part of the cybersecurity discussion surrounding North Korean hacking operations and the broader increase in sophisticated cyberattacks. AI tools can potentially help attackers research vulnerabilities, automate tasks, and develop malicious code more efficiently.

However, there is currently no public confirmation that artificial intelligence was directly used to execute the Binance breach. The specific attack methods identified so far involve compromised internal access, wallet authorization, and coordinated blockchain transactions.

How the Attack May Have Happened

Binance's initial investigation pointed to a potentially compromised laptop belonging to a DevOps engineer.

According to the exchange, the laptop may have allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. Binance emphasized that it had found no evidence of a wallet private key leak.

The distinction is important. A cryptocurrency wallet does not necessarily need to have its private key stolen for an attacker to move funds. If an attacker gains control over the systems responsible for approving or submitting transactions, they may be able to misuse legitimate signing infrastructure.

Binance later stated that its investigation had uncovered additional points of breach, suggesting the incident was more complex than its initial findings indicated.

The exchange has not yet released a complete technical post-mortem. It says it will publish additional details once its investigation is complete and the facts have been verified.

The FBI has confirmed that it is aware of the incident and is working with relevant public and private partners to understand the scope of the activity and coordinate investigative steps.

Tether, Circle and Other Companies Freeze Billions

One of the most significant developments following the attack has been the response from stablecoin issuers and blockchain networks.

Because stablecoins such as USDT and USDC are centrally issued, their companies can freeze specific tokens held at identified wallet addresses. That ability gave investigators and industry partners an opportunity to prevent some of the stolen funds from being moved.

Tether froze more than $1.5 billion in USDT associated with the incident, according to CEO Paolo Ardoino. Circle also confirmed that it had frozen more than $800 million in USDC in coordination with law enforcement.

Ripple and World Liberty Financial also froze assets connected to the attack. Arbitrum's Security Council used its emergency powers to move additional ETH and ARB out of an attacker-controlled wallet.

TRM's initial breakdown estimated approximately $2.7 billion in frozen assets and tokens. Binance subsequently reported that roughly $3 billion had been frozen on-chain.

The difference reflects evolving investigations and additional recovery actions as companies continue tracing the funds.

Despite these efforts, the attacker managed to convert some stolen stablecoins into assets that cannot be frozen by a centralized issuer. TRM reported that hundreds of millions of dollars in USDT were exchanged for ETH through decentralized trading infrastructure and that additional funds were used as collateral in lending protocols.

This created a race between the attacker attempting to move assets and companies attempting to freeze them.

Bitcoin Falls Toward $76,000 as Investors React

The news triggered a broad selloff across cryptocurrency markets.

Bitcoin fell to approximately $76,000 during the overnight decline, reaching its lowest level since September 18 before recovering some of its losses. Ether also dropped, briefly trading near $2,170, while BNB, XRP, and other major cryptocurrencies experienced additional selling pressure.

The market reaction was not limited to spot trading. CoinDesk reported that cryptocurrency futures liquidations reached approximately $1.57 billion as leveraged positions were forced to close.

Long positions accounted for a substantial portion of the liquidations, reflecting the damage caused to traders who had been betting on higher prices.

The Binance incident also placed pressure on publicly traded companies with significant exposure to cryptocurrency markets. Shares of Coinbase, Strategy, and Circle faced declines as investors reassessed the potential impact of the breach.

Despite the market reaction, analysts have pointed out an important distinction: a security breach does not automatically mean an exchange is insolvent.

Binance has stated that customer funds are safe and that it will cover all losses. The exchange also maintains a Secure Asset Fund for Users, commonly known as SAFU, which is designed to provide an additional layer of protection in extreme situations.

Whether the incident produces longer-term consequences for market confidence will depend partly on how quickly Binance restores normal operations and demonstrates that customer balances remain fully backed.

Binance Suspends Withdrawals and Promises to Cover Losses

Following the breach, Binance temporarily suspended deposits and withdrawals while security checks were completed.

The exchange said deposits were unaffected, but withdrawals on affected networks remained paused as investigators worked to secure the infrastructure and revoke compromised address authorizations.

Binance confirmed that it would cover all losses using its SAFU fund and company resources. It also committed to publishing an updated Proof of Reserves once remediation work is complete.

This reassurance is important given the scale of the incident. Binance is the world's largest cryptocurrency exchange by trading volume, and a prolonged interruption could create significant uncertainty for customers and the broader market.

The company has also engaged law enforcement and blockchain intelligence partners to trace the stolen assets and identify those responsible.

At the time of writing, Binance expected withdrawals to resume within approximately the next 45 hours, although users should rely on official exchange updates for the latest operational information.

Polymarket Also Faces a Separate Security Incident

The Binance breach was not the only major cryptocurrency security incident reported during the same period.

Prediction market platform Polymarket temporarily suspended trading on its international platform after a separate security issue involving a compromised third-party provider.

The incident reportedly resulted in approximately $2.6 million to $2.7 million in user losses. Polymarket said it had identified and fixed the issue, referred the matter to law enforcement, and would reimburse affected users.

The two incidents have drawn attention to the risks associated with third-party infrastructure and external service providers.

Although the Polymarket incident was separate from the Binance breach, their timing added to concerns across the cryptocurrency industry. Exchanges, decentralized applications, and other digital asset platforms rely on complex networks of software providers, internal systems, and external services. A weakness in any part of that infrastructure can create opportunities for attackers.

The incidents also reinforce the importance of security reviews that extend beyond the blockchain protocols themselves.

What the Binance Hack Means for the Cryptocurrency Industry

The Binance breach raises serious questions about how major cryptocurrency platforms secure their internal systems and authorize transactions.

For years, much of the industry's security discussion has focused on private key protection, hardware wallets, smart contract vulnerabilities, and exchange custody. This incident highlights another critical area: the infrastructure responsible for approving and executing transactions.

Even when private keys are not directly exposed, compromised systems and authorization processes can potentially allow attackers to move enormous amounts of cryptocurrency.

The ability of stablecoin issuers and blockchain networks to freeze or recover certain assets also demonstrates both the advantages and limitations of the current digital asset ecosystem. Centralized issuers can intervene in specific circumstances, but Bitcoin and other assets without a centralized issuer cannot simply be frozen in the same way.

For exchanges, the incident is likely to increase scrutiny of employee devices, internal permissions, transaction approval systems, and the separation of duties within security operations.

For investors, it is another reminder that holding cryptocurrency on an exchange introduces risks beyond the price movements of the assets themselves.

What Happens Next?

The investigation into the Binance breach remains ongoing. TRM Labs and other blockchain intelligence firms are continuing to track the stolen assets, while Binance works with law enforcement and industry partners to recover funds and restore normal services.

Approximately $3 billion has been frozen or secured according to Binance's latest public update, but billions of dollars remain part of the broader investigation.

The exchange has promised to cover customer losses, and the next major developments will likely involve the restoration of withdrawals, a detailed technical explanation of the breach, and further information about the recovery of stolen funds.

For now, the incident stands as a major test of cryptocurrency exchange security. It demonstrates how quickly a sophisticated attacker can exploit weaknesses in internal infrastructure, even at one of the largest companies in the industry.

The full financial impact may ultimately be absorbed by Binance, but the consequences for market confidence, cybersecurity standards, and the broader cryptocurrency ecosystem could last considerably longer.