Following the $6.3B: how investigators traced the Binance hack to North Korea

Three days after the largest theft in the history of crypto, the picture has sharpened. On October 31 the FBI publicly attributed the roughly $6.3 billion taken from Binance to TraderTraitor, the North Korean state hacking unit it also blamed for the $1.5 billion Bybit theft in February 2025. Blockchain analytics firms TRM Labs, Chainalysis and Elliptic had reached the same conclusion within hours of the attack, using nothing but public ledger data and their own intelligence. This article walks through what the transaction trail shows, why investigators point to Pyongyang, and how the case is likely to develop.

Ten blockchains, twenty minutes

The theft began at 20:05 UTC on October 29, when five Binance wallets on the XRP Ledger sent 233.46 million XRP to a single address. Within minutes, Binance wallets on Solana and Optimism followed. At 20:20 UTC a bitcoin hot wallet released 18,270 BTC, and a Tron wallet sent 612.7 million USDT and 46.4 million TRX. The largest blow landed on Ethereum, where a hot wallet was emptied of 167,464 ETH, 1.615 billion USDT and dozens of other tokens. A second wave hit Binance wallets on Avalanche and Polygon around 23:05 UTC.

Estimates of the total differ slightly because each firm prices the assets at a different moment. Binance puts the loss at about $6.3 billion, TRM Labs at $6.36 billion and Elliptic at $6.43 billion across 11 networks. By any measure it is more than four times larger than Bybit, and Elliptic notes it is more than six times larger than the $1 billion removed from Iraq's central bank in 2003, previously the largest theft of any kind.

How the attacker got in

The Ethereum leg relied on EIP-7702, a feature added in the Pectra upgrade of May 2025 that lets an ordinary wallet run smart-contract code after signing an authorization. According to TRM Labs, the attacker submitted one transaction containing 50 pre-signed authorizations for consecutive nonces, so that one of them would match whatever the hot wallet's transaction count happened to be. One did, and the wallet became a sweeper that answered only to the attacker. Because that hot wallet also acted as executor for a separate Binance smart account, the attacker could pull a further 823 million USDC.

On the other nine chains there was no clever contract trick, only ordinary transactions with valid signatures. That detail matters more than EIP-7702. Wallets on ten networks use different keys and signing schemes, yet all of them produced valid signatures within about half an hour. TRM's assessment is that the attacker gained the ability to make Binance's hot-wallet signing system approve transactions of its choosing. Binance's preliminary finding pointed to a compromised laptop belonging to a DevOps engineer and later to additional breach points it has not yet described.

The North Korea fingerprints

Attribution in crypto rests on patterns, and this one fits a well-documented playbook. The attacker's operator wallet was funded on the morning of October 28 with three small Tornado Cash withdrawals. The attack code was deployed and tested on two wallets, rehearsed on a third, and installed on a Binance hot wallet about four hours later. Signatures gathered in advance were then executed in one burst. TRM Labs, which rates its attribution as high confidence, says the same pattern appeared in the Bybit theft and in the April 2026 KelpDAO hack.

Chainalysis added the decisive on-chain link: stolen Binance funds were commingled with proceeds of the September 2026 Bitget theft, which had already been tied to North Korea. Elliptic found shared service usage with three earlier TraderTraitor thefts, at BigONE, WOO X and AFX. The FBI then confirmed the attribution, published Ethereum, Bitcoin and Solana addresses linked to the operation, and asked the industry to block transactions connected to them.

The stakes go beyond one exchange. Elliptic estimates that North Korea-linked actors have stolen more than $6.5 billion in recent years, including over $1 billion in 2026 before this incident. If the attribution holds, a single night at Binance nearly doubles that total. United Nations monitors and Western governments have long said that this money helps finance Pyongyang's weapons programmes.

The race to freeze

Stablecoin issuers moved faster than in any previous hack. Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC, about 40 minutes after the main sweep, and its total freezes later reached roughly 1.77 billion USDT. Circle froze about 823 million USDC three minutes later in coordination with law enforcement. Ripple froze 40.5 million RLUSD, World Liberty Financial froze 27.8 million USD1, and Arbitrum's Security Council forcibly moved 8,426 ETH and 74.6 million ARB out of an attacker wallet. Elliptic has verified $2.85 billion frozen or seized, about 44% of the theft.

The attacker reacted by dumping stablecoins at a steep loss. Elliptic counts about $786 million converted to ETH and TRX before freezes took effect, including 434 million USDT swapped for 160,451 ETH at a 12% to 26% discount to market, and a loan of 19,762 ETH taken from Aave against stolen USDT before Aave froze the affected markets. On Tron, the main wallet made 546 transfers with a median gap of 96 seconds, a sign of automated laundering.

What is still out of reach

The uncomfortable number is the part no issuer can freeze. Elliptic puts it at about $3.21 billion, including some 519,000 ETH, all 18,270 BTC, 233 million XRP and around 475 million TRX. The bitcoin was split through a peel chain into 19 addresses, most holding exactly 1,000 BTC, and as of the latest updates none had reached an exchange or other service. Bitcoin has no central issuer and no blacklist function, so those coins can only be stopped when they touch a business that screens deposits.

Binance, meanwhile, has focused on making customers whole. The exchange set aside more than $6.34 billion of corporate funds and said on October 31 that it had replenished 90% of the stolen assets through market and over-the-counter purchases. It said it remained on track to reopen withdrawals on November 1 and to publish a full proof-of-reserves report shortly after. Any recovery of frozen funds would come on top of that reserve.

Three scenarios for what comes next

Scenario one, the Bybit path, is the most likely. After Bybit, North Korean launderers moved most of the stolen ether within weeks through cross-chain swap protocols, chains of fresh wallets and, finally, over-the-counter brokers who convert crypto to cash, often in Asia. TRM, Chainalysis and Elliptic all expect the Binance funds to follow bridges, swap services and OTC desks in the coming weeks. Under this scenario the frozen $2.8 billion stays frozen, but very little of the remaining $3 billion is ever recovered.

Scenario two is a long wait. North Korean groups have sometimes left coins untouched for months or years until scrutiny fades. The 19 bitcoin wallets with round 1,000 BTC balances look like storage rather than a laundering pipeline. If they stay dormant, the case turns into a long watch in which every exchange and OTC desk has to screen against the published addresses indefinitely.

Scenario three is partial recovery. The scale of this theft is itself a problem for the launderers. Moving more than $3 billion through OTC brokers without touching a regulated business is extremely difficult, and every exchange now has the FBI and Elliptic address lists. Each time a fragment lands at a compliant venue, it can be frozen. Recovery in this scenario would likely come in small pieces over many months rather than in one large seizure.

Whatever the path, the regulatory consequences are already taking shape. Expect supervisors to ask whether hot-wallet limits, separation of signing systems by chain, and monitoring for EIP-7702 delegations should become formal requirements. Pressure on OTC desks and cross-chain protocols to screen flows in real time will grow. Binance's November reserve report and its promised technical post-mortem will be read closely by regulators and rival exchanges alike.

What affected users and businesses can do

Binance customers are covered by the exchange's reserve, so most retail users do not need to act beyond watching for the reopening of withdrawals and the reserve report. The bigger risk for ordinary users is the wave of fraud that follows every major hack: fake support agents, bogus 'recovery' services and phishing sites promising to return lost funds for a fee. Binance will not ask for passwords or seed phrases, and no legitimate investigator can guarantee recovery.

Companies and individuals who have lost money in a theft or scam, or who suspect their funds have passed through addresses linked to an incident like this, should document every transaction hash, report to the police and the relevant platforms quickly, and work with qualified blockchain forensics specialists. Firms such as Crypto Alba Trust, which describes itself as an international investigations firm founded in 2017 and positions itself among the leading specialists in crypto investigations and asset tracing, offer multi-chain path reconstruction, exchange deposit tracking and support for recovery cases. Speed matters: as the Binance case shows, freezes are only possible while funds are still in assets or at venues that can act.

The Binance theft has shown both sides of crypto's transparency. Every movement of the stolen money is visible, which allowed analysts to attribute the attack within hours and issuers to freeze billions within minutes. But visibility is not control. The next phase depends on whether exchanges, OTC desks and protocols act on what they can see before the remaining funds disappear into the cash economy.

Source: FBI, TRM Labs, Chainalysis, Elliptic, Binance, CNBC, Cointelegraph, Seoul Economic Daily

CoinShark Media

Independent crypto, Web3 and fintech news since 2017.

info@thecoinshark.com

© 2017–2026 CoinShark Media. All rights reserved.