Binance hot wallet theft estimated at $6.3 billion, analysts link it to North Korea

Cryptonews and Bitcoin Magazine both put the affected amount at about $6.3 billion, while Bitcoin Magazine also noted that Chainalysis placed the total at $6.4 billion. Fortune Crypto described the incident as almost certainly carried out by North Korea. Unchained reported that the outflows came from Binance-controlled hot wallets on October 29, with TRM Labs counting roughly $6.36 billion across 10 networks.

Binance has said its early review points to a laptop belonging to a DevOps engineer, which Binance says let an intruder reach a service container and push through withdrawals it did not authorize. Cryptonews reported that co-CEO Richard Teng argued the attacker did not rely on one employee's permissions and described a multi-stage operation. Binance said it found no sign that wallet private keys leaked. Withdrawals are suspended while the exchange overhauls its withdrawal infrastructure, and Cryptonews reported that deposits continue to operate.

Bitcoin Magazine reported that Chainalysis and TRM Labs linked the theft to TraderTraitor, a unit associated with North Korea. Unchained reported that TRM assigned the theft to that group with high confidence, and that ZachXBT said funds from a separate Bitget exploit were mixed together at one address. Protos described the technical method: the attacker set up a sweeper contract and sent 50 Ethereum delegation authorizations aimed at one hot wallet, while other wallets did not depend on that approach. Bitcoin Magazine placed the start of outflows around 4:20 p.m. Eastern on October 29, whereas Unchained cited a TRM burst beginning at 20:05 UTC.

Bitcoin Magazine reported that the attacker tried to get ahead of freezes by turning stablecoins into ether and other assets issuers cannot freeze, with roughly $325 million converted into about $285 million of ether within around 20 minutes. Cryptonews and CryptoPotato each said about $3 billion was frozen, while Protos reported about $2.4 billion frozen or blacklisted on Ethereum. Unchained gave a separate Ethereum-only figure of roughly $3.5 billion. Bitcoin dipped toward $76,000 on Friday, and Bitcoin Magazine reported total liquidations of $1.5 billion.

Binance has said it will make users whole using its SAFU fund and company money. Unchained reported that the exchange set aside more than $6.34 billion of its own money, and co-CEO Yi He expected withdrawals to restart within 48 hours. Unchained also said user funds would be verified through Proof of Reserves. Binance has not named an attacker, and investigators are still working to identify those responsible.