Signal Snapshot
Three firms blame North Korea for a $6.4 billion Binance hack.
- TRM Labs and Chainalysis blame TraderTraitor for the Binance theft.
- TRM puts the loss at about $6.36 billion across 10 blockchains.
- Chainalysis puts the total at about $6.4 billion.
- Most funds moved in about 20 minutes from 4:05 p.m. ET Thursday.
- Binance says it set aside over $6.34 billion to cover losses.
- The top risk is quick cash outs that shrink recovery odds.
Key Takeaways
- What happened: three firms tied the Binance hack to North Korea.
- Why it matters: the size makes it the largest crypto theft on record.
- The investor read: watch Binance payouts, frozen coins, and faith in exchanges.
What Happened
TRM Labs made the call with high confidence. It pointed to on and off chain intel. It said about $6.36 billion left Binance wallets. The move hit 10 blockchains at once. Most funds moved in about 20 minutes. The rush started at 4:05 p.m. ET Thursday.
Chainalysis put the total at about $6.4 billion. Its best clue was live fund mixing. It saw Binance funds commingling in real time with older loot. That older loot came from last month’s Bitget exploit. That exploit had been tied to North Korean actors.
TRM named TraderTraitor as the crew. The FBI had blamed the same crew for the $1.5 billion Bybit hack. That hack took place in February 2025. TRM said Binance was about four times bigger. It called the theft the largest crypto theft on record.
A third firm backed the North Korea view. Singapore-based Pangolin Intelligence spoke to CNN. It cited on chain patterns and past cases. A Chainalysis spokesperson also told CNN it had high confidence. North Korea has denied past hacking claims.
Both TRM and Chainalysis flagged Tornado Cash. They said the attack wallet drew funds through the mixer. A mixer blends coins to hide the trail. TRM said setup work started well before theft day. That early staging matched the Bybit hack. It also matched April’s KelpDAO exploit. On Ethereum the attacker used EIP-7702 delegation. That tool came with Ethereum’s Pectra upgrade.
Binance said it reserved over $6.34 billion in firm funds. About $5 billion is already held in the hit tokens. The goal is to cover user losses in full. The speed of the drain shocked even pros. Twenty minutes for billions means deep prep. It also means tested exits.
Why It Matters
This is a security event, not a normal market dip. Price swings fade fast. Trust breaks last longer. The size forces focus. About $6.4 billion dwarfs the $1.5 billion Bybit theft. That gap tells you scale has changed. Crews can now drain many chains at once. Ten blockchains in 20 minutes is speed, not luck. Speed points to long prep. TRM said staging began well before theft day. That fits a pro crew with practice.
The commingling clue matters more. Binance loot mixed live with Bitget loot. Shared pipes often mean shared hands. That link let two firms point to TraderTraitor. It is a second order tell. Reused cash out paths speed the next theft. They also give hunters a trail to watch.
For users the fear is plain. Will Binance cover all losses. The firm says yes, with over $6.34 billion set aside. About $5 billion sits in the hit tokens now. That cover calms panic but locks up firm cash. Locked cash can limit buys, loans, and deals.
For the market the rail at risk is exchanges and custody. Exchanges hold keys. Custody keeps coins safe. Settlement moves value. A break at one step shakes the rest. If big venues look soft, traders pull funds. If funds sit idle, trades slow. Watch for proof of full payouts, not words. Words calm a day. Cash calms a month.
Token Metrics View
Token Metrics flagged this as a main item in Daily Pulse coverage. That tag means it rose above daily noise. Size drove the call. A multi chain drain of about $6.4 billion is rare. Attribution drove it too. Three firms named North Korea. That fast agreement is rare in hacks.
The data read is simple for now. Focus stays on fund moves, not price charts. No bounce can erase a theft this big. The one number to track is Binance cover. Over $6.34 billion reserved is the backstop. About $5 billion in hit tokens is the first buffer. If frozen funds grow, pressure eases. If mixers drain funds fast, pressure builds. Token Metrics will keep this in Daily Pulse until flows settle. That keeps eyes on wallets, freezes, and payouts.
Market Context
This fits a security event with market structure fallout. It is not a rules shift. It is not a tech launch. It is a theft that tests pipes. The source cites a clear yardstick. The Bybit hack was $1.5 billion in February 2025. The FBI blamed TraderTraitor for that theft. TRM says Binance is about four times bigger. That frame shows how fast crew scale has grown.
Multi chain hits spread pain wide. Ten chains means more tokens hit at once. More users feel it. More desks must react. Mixer funding adds a second thread. Tornado Cash moved the seed funds, both firms say. Early staging adds a third thread. Prep plus speed plus mixing looks like past North Korea work. TRM also points to April’s KelpDAO exploit as a match.
For exchanges the lesson is cold. Hot wallets pay for speed with risk. Big cover funds help after the fact. They do not stop the break in. Users learn to ask where keys live. Builders learn to limit per wallet caps. The market learns that size draws pros. Bigger pots need stronger locks.
Risks to Watch
Fast laundering is risk one. Mixers and swaps can split funds in hours. Each split makes freeze and claw back harder. Each hop adds new coins and chains.
Copycats are risk two. News of a big win can spur look alike raids. Weak signing setups face more probes now. Teams should check keys and limits.
Payout strain is risk three. Even with $6.34 billion reserved, full pay takes time. Token gaps can force sales or swaps. Sales can move thin books.
Trust flight is risk four. Users may pull coins from big venues. That can thin books and lift spreads. It can also slow new sign ups.
What would make this matter less. Quick freezes, firm payout proof, and slow mover wallets. If coins sit still, hunters gain time. If Binance pays fast, fear fades. If funds race through mixers, the read turns worse.
What to Watch Next
- Watch Binance payout updates and proof of full cover. Look for wallet posts. Look for user reports of paid claims. Words are not proof. Paid claims are.
- Watch freeze tags on the 10 hit chains and mixer exits. Frozen coins buy time. Moving coins cut time. Track which side is winning.
- Watch for law alerts that name wallets or seize funds. Seizures shrink the float of loose loot. New tags help exchanges block deposits.
- Watch for exchange safety steps like key shifts and caps. Lower hot wallet caps cut next loss size. Slower signs add friction but add safety.
- Watch for links to the Bitget loot path. More shared pipes firm up the shared crew view. Fewer links would soften the call.
This piece is for info only. It is not financial advice.
Sources / Data Used
- Binance hack attribution details
- Token Metrics data used: Daily Pulse main items flag and October 30 snapshot for ticker TO.
