Key points
- TRM Labs links the Binance theft to North Korea's TraderTraitor
- Binance sets aside $6.34 billion to cover the loss
- Coinbase and Circle shares fall after the hack
Binance says it has set aside more than $6.34 billion to cover the roughly $6.3 billion stolen from its online wallets on October 29. Blockchain analytics firm TRM Labs has attributed the theft to North Korea's TraderTraitor hacking group.
About $5 billion of the funds set aside is held in the same tokens that were stolen, covering roughly 80% of the loss, Binance co-CEOs Yi He and Richard Teng said in an October 30 update. The exchange is buying the remaining tokens through market and over-the-counter channels.
"Binance will absorb the financial impact of these stolen funds, not our users," they wrote.
Crypto stocks fell on October 30, the first trading day after the hack. Coinbase (COIN) shares dropped 10.6%.
TRM Labs ties the theft to North Korea's TraderTraitor
TRM Labs attributes the attack to TraderTraitor, a North Korean state-sponsored hacking group, based on what it called robust on-chain and off-chain intelligence. The FBI named the same group as responsible for the $1.5 billion Bybit hack in February 2025, the largest crypto theft before this one.
TRM traced about $6.36 billion leaving Binance wallets on 10 blockchains, most of it in about 20 minutes starting at 4:05 p.m. ET on October 29. Several features match earlier North Korea-linked thefts, including Bybit, TRM said. The attacker's wallet was funded with small withdrawals from Tornado Cash, a service that hides where crypto comes from. Preparation began at least 36 hours before the theft, and signatures were obtained in advance and then used in one burst.
In TRM's assessment, the attacker most likely gained the ability to make Binance's hot wallet signing system sign transactions of its choosing on several blockchains. Binance said its first finding pointed to a compromised engineer's laptop, but that its later investigation "has uncovered additional points of breach." Binance said it has found no evidence that wallet private keys leaked, and it expects to share more technical findings within about 48 hours.
The FBI and the US Secret Service are working with Binance, Reuters reported.
TRM says the attacker still controls about $2.4 billion in crypto
Binance said about $3 billion has been frozen on-chain. TRM counted about $2.7 billion frozen as of 8:30 p.m. ET on October 29, mostly stablecoins blocked by their issuers. Tether froze about 1.77 billion USDT, Circle (CRCL) about 825 million USDC, Ripple 40.5 million RLUSD, and World Liberty Financial 27.8 million USD1.
Bitcoin and Ether have no central issuer that can freeze them. As of 8:30 p.m. ET on October 29, the attacker still controlled more than 420,000 ETH and 18,270 bitcoin, worth about $2.4 billion, TRM said. TRM expects those funds to move next through cross-chain bridges, swap services, and over-the-counter brokers.
Binance plans to reopen withdrawals in phases
Withdrawals have been suspended since the hack, while deposits still work. In its October 30 update, Binance said it aims to start resuming withdrawals in phases within about 34 hours, subject to security checks. Counting from the 3:33 p.m. update, that points to about 1:33 a.m. ET on November 1, by our calculations.
Binance also plans a new Proof of Reserves snapshot, with results by November 2, and a full technical report on the attack. Binance is the world's largest crypto exchange by trading volume. It said it's working with law enforcement, token issuers, and other exchanges to recover the stolen funds.
Crypto stocks fell on the first trading day after the hack
The theft began after the US stock market closed on October 29. On October 30, Coinbase fell 10.6% to $143.54, Circle fell 9.3% to $72.54, Strategy (MSTR) fell 7.8% to $130.51, and Robinhood (HOOD) fell 7.2% to $84.99. Coinbase had also reported its third-quarter results after the close on October 29, and the Nasdaq Composite fell 2.9% that day in a broad tech selloff.
Bitcoin traded at $77,300 and BNB, the token tied to Binance, at $704.23 at 10:10 p.m. ET on October 30, according to CoinGecko. Our earlier report covers Binance's first statements on the incident and the stablecoin freezes.
