Cryptocurrency investigators and firms are racing to track billions of dollars in stolen digital cash following what appears to be the largest crypto heist in history. On Thursday, October 29, starting around 4 p.m. ET, hackers began siphoning approximately $6.3 billion in cryptocurrencies from wallets belonging to the exchange Binance. The theft spanned multiple blockchains and was executed with remarkable speed, draining funds in a period of roughly 20 minutes according to analysis by TRM Labs.
In response to the breach, Binance immediately suspended all deposits and withdrawals to facilitate its investigation. The company stated that it is working to identify those responsible and has coordinated with other crypto firms to freeze approximately half of the stolen funds. This action effectively halted further movement or cash-out attempts for a significant portion of the assets, though much of the remaining cryptocurrency may be impossible to recover.
Three major crypto tracing firms have linked the attack to North Korean hackers, specifically pointing to the notorious group known as TraderTraitor. Tom Robinson, chief scientist and co-founder of Elliptic, noted that if North Korea is indeed responsible, this single theft would nearly double the total amount the regime has stolen in cryptocurrency to date. While neither Binance nor law enforcement officials have officially named a suspect, researchers highlight significant overlaps with previous attacks attributed to TraderTraitor.
TRM Labs detailed the attacker's methodology, revealing that preparation began at least 36 hours prior to the theft. The group tested their code on two wallets early on October 29 and rehearsed the final version on a third wallet later that day before routing test funds back to themselves. Four hours after this rehearsal, the same code was installed on a Binance hot wallet, which are internet-connected accounts used by exchanges to handle customer withdrawals. The attack drained these hot wallets across at least ten blockchains, including Ethereum, Bitcoin, Tron, and Solana.
TraderTraitor has become known for targeting cryptocurrency and decentralized finance companies with sophisticated, high-profile attacks. Last year, the FBI attributed a $1.5 billion hack against the exchange Bybit to this group. Rafe Pilling, a senior director of threat intelligence at Sophos, described the group as artists in infiltrating distributed finance organizations, noting their history of developing fake applications to gain access.
Chainalysis and TRM Labs based their attribution on both on-chain and off-chain activity analysis. Chainalysis investigators observed in real-time that funds stolen from Binance were commingling with funds from a Bitget exploit last month, which had already been attributed to North Korean actors. Elliptic's Robinson added that the attacker funded their wallet through Tornado Cash and rehearsed the attack in advance, mirroring tactics used in the Bybit incident.
Binance initially suggested the security incident involved a compromised engineer's laptop but later uncovered additional points of breach in a complex attack. The company has committed to covering all losses from the hack while cooperating with law enforcement. However, recovery efforts face significant hurdles; while approximately $2.8 billion, or 44 percent of the total stolen amount, has been frozen—mostly consisting of stablecoins—the remaining $3.3 billion is primarily Bitcoin, Ether, and XRP.
Robinson explained that these specific assets cannot be frozen directly and can only be stopped when they reach an exchange or other service. Although some funds may be caught in the coming months, experts do not expect the frozen share to rise significantly further. Chainalysis researchers noted seeing unprecedented money laundering patterns, with thousands of transactions processed quickly using automation to obscure the trail of the stolen funds.
Sources: WIRED.