Binance says it has replaced 90 percent of the $6.3 billion in digital assets stolen from its wallets, putting the exchange on course to reopen customer withdrawals on November 1. Blockchain-intelligence firms attribute the operation to TraderTraitor, a North Korean state-linked cyber unit, in what would be the largest cryptocurrency theft ever recorded.
The intrusion was not a spontaneous exploit. TRM Labs found that the operator’s wallet received three small transfers from Tornado Cash, a crypto-mixing service used to obscure transaction origins, on the morning of October 28 — at least 36 hours before the main theft.
Later that day, the attacker deployed attack code and tested it on two Binance wallets. A final rehearsal was run on a third wallet, with the test funds routed back to the operator. Four hours after that rehearsal, the same code was installed on a Binance hot wallet.
At about 20:05 UTC on October 29, the attacker began draining funds across ten blockchains. Most of the approximately $6.36 billion moved within roughly 20 minutes.
How access was gained
Binance’s first assessment identified a compromised laptop belonging to a DevOps engineer as the entry point. The company said the attacker used that access to reach a service container and submit unauthorized withdrawal transactions.
The exchange later broadened its account of the breach, saying investigators had identified additional “points of breach.” That shift suggests the operation involved more than one compromised device or credential, though Binance has not publicly detailed the other access paths.
The intrusion bypassed ordinary withdrawal safeguards long enough for the attackers to move assets at a scale that overwhelmed the exchange’s real-time controls. Binance has not said whether insider assistance is suspected.
Attribution and North Korea’s playbook
TRM Labs attributed the attack to TraderTraitor “with high confidence,” citing both on-chain and off-chain intelligence. Chainalysis reached the same conclusion, with CEO Jonathan Levin saying the theft was likely carried out by the group.
TraderTraitor is associated with North Korea’s Lazarus Group and APT38, units that Western investigators say finance the regime through cybercrime. The FBI previously linked TraderTraitor to the $1.5 billion theft from Bybit in February 2025; the Binance loss is roughly four times larger.
Chainalysis investigators also reported that proceeds from last month’s Bitget exploit were mixed with funds taken from Binance, indicating possible operational overlap between recent campaigns.
North Korea has repeatedly denied involvement in cryptocurrency thefts.
The response
Binance suspended deposits and withdrawals shortly after detecting the outflows and began working with blockchain partners to trace and freeze stolen assets. About $3 billion in affected assets was ultimately frozen.
The attackers had converted roughly $786 million into harder-to-trace currencies by the time the freeze efforts took hold, according to Elliptic. TRM estimated that the hackers still controlled about $2.4 billion in Bitcoin and Ethereum after the freezes.
Binance committed to absorbing the full financial impact rather than passing losses to customers. It said it funded the replacement assets through its corporate treasury, part of its futures insurance fund, and its Secure Asset Fund for Users, or SAFU.
By October 31, the company said it had replenished 90 percent of the stolen amount, up from about 80 percent a day earlier. Ten major tokens — including Bitcoin, Ether and Tether’s USDT — were fully backed in a new proof-of-reserves snapshot taken at 00:00 UTC that day.
The remaining 10 percent consists of less-liquid tokens outside the exchange’s top holdings, which Binance says may take longer to source. It expects to publish a full proof of reserves around November 3.
What comes next
The immediate test is whether Binance can restore withdrawals on schedule without reigniting liquidity pressure or exposing further weaknesses. The longer-term questions concern the exchange’s operational-security architecture: how attackers obtained signing authority, why the malicious code could be installed on a hot wallet, and why the transaction flow was not halted sooner.
For policymakers, the case adds to evidence that North Korea’s cyber program treats exchanges as a revenue source at industrial scale. TRM’s Ari Redbord said funds stolen at this scale likely support weapons proliferation, making asset freezing and tracing a counter-proliferation issue as much as a consumer-protection one.
