Binance theft of $6.43 billion is attributed to North Korea as withdrawals reopen

Binance lost $6.43 billion in cryptoassets on October 29, according to the blockchain analytics firm Elliptic, and the FBI attributed the theft on October 31 to North Korea's TraderTraitor hacking group, CoinDesk reported.

Four hours of withdrawals, and a race against the issuers' freezes

Elliptic's timeline puts the theft between 20:05 and 23:56 UTC on October 29. Of the $6.43 billion taken, $3.46 billion, or 54%, was in stablecoins such as USDT and USDC, which their issuers can freeze. Binance has said the attack began with a compromised engineer's laptop, Elliptic wrote.

Tether froze the stolen USDT on Ethereum 37 minutes after it reached the attacker's wallet, and Circle froze all 823 million USDC before any of it was swapped, according to Elliptic. About $786 million of stablecoins was converted into other assets before the freezes landed. In total, $2.85 billion has been frozen or seized.

The FBI described the loss in rounder terms, as "more than $6 billion". Figures differ by source and date, and Elliptic said its description of a fast-moving situation may not be complete.

The FBI names TraderTraitor and publishes its addresses

In a post on October 31, the FBI Cyber Branch said it was advising that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, as quoted by Decrypt. CoinDesk reported that the FBI listed over 600 Ethereum addresses, just under 20 Bitcoin addresses and a single Solana address, and urged private-sector entities including THORNode operators, RPC node operators, instant exchanges and DeFi services to block transactions with them.

North Korea has rejected the attribution. Kim Yo-jong, the sister of leader Kim Jong-un, said in a statement carried by Yonhap News Agency that "The FBI is trying to brand the DPRK as a 'cyber criminal state'", The Block reported on November 2.

Where the money sat on Monday morning

As of about 07:00 UTC on November 2, Elliptic counted $3.24 billion still in addresses linked to the theft, mostly ETH and BTC, with a negligible amount likely cashed out. The firm said those unmoved funds are "very likely still held by North Korea".

The laundering used about 12,000 wallets across 11 blockchains and more than 40,000 transactions in under four days, roughly one new wallet every 25 seconds. Elliptic called it clearly automated and said "nothing we have seen shows an AI agent making decisions". Since November 1 about 28 BTC, worth $2.2 million, has gone through coinjoins, which mix many users' bitcoin in one transaction. Based on the Bybit case, Elliptic said it expects the attacker to swap the ETH for bitcoin and try to cash out through over-the-counter brokers and exchanges.

Customers withdrew $3.64 billion in nine and a half hours

Binance began restoring withdrawals in phases at 1 a.m. ET on Sunday, November 1. Between 1 a.m. and 10:30 a.m. ET it processed $4.65 billion in withdrawals and $1.01 billion in deposits, a net outflow of about $3.64 billion, which the exchange put at 2.1% of its $171 billion in assets, according to The Block.

Chief executive Richard Teng wrote on November 1 that "Binance will absorb the financial impact of the stolen funds, not our users", as quoted by Decrypt. Decrypt also reported that Binance took a new reserves snapshot on October 31 and expected to publish an updated report.

A custody failure that issuer freezes, not the exchange, contained

We think this is a custody and security story before it is a market story. The facts above point to an operational weak point, a compromised engineer's laptop, and to the issuers' freezes of $2.85 billion as what limited the loss. That is the opportunity in the episode: fast freezes and shared address lists worked on the assets that can be frozen. The threat is the other half, because ETH and BTC cannot be frozen and most of the $3.24 billion Elliptic still tracks is in them.

We expect the cash-out to be slow and visible if the Bybit pattern repeats, and we do not forecast price levels. Our view would change if Binance's updated reserves report showed a larger gap than the 2.1% outflow suggests, or if the unmoved bitcoin were cashed out quickly.

The view in this final section is FinanceInTime's editorial opinion, for information only. It is not investment, tax, legal or other advice, and it does not take your circumstances into account. Forecasts are uncertain and past results do not guarantee future ones.