Table of Contents
Cryptocurrency exchange Binance experienced a massive $6.3 billion security breach where hackers drained funds across multiple blockchains in a span of roughly 20 minutes. Following the incident, Binance halted all deposits and withdrawals while investigating the breach and cooperating with law enforcement agencies to identify the culprits.
Tracing the Attack and Suspected Links
Analysis by crypto tracing firm TRM Labs reveals that the majority of the stolen assets were taken on October 29. The attacker targeted Binance wallets spanning at least ten blockchains, including Ethereum, Bitcoin, Tron, and Solana, funneling the funds into multiple controlled addresses. TRM Labs noted in a blog post that preparation for the heist began at least 36 hours prior.
Three crypto tracing firms have quickly connected the operation potentially to North Korean hackers. Tom Robinson, chief scientist and cofounder of Elliptic, told WIRED that North Korea is likely responsible, noting that this single theft would nearly double the total cryptocurrency stolen by the regime to date. Both TRM Labs and Chainalysis pointed specifically to an elite subset of North Korean hackers known as TraderTraitor, while Elliptic noted operational overlaps without explicitly naming the group.
Neither Binance nor law enforcement officials have publicly confirmed any suspected links to North Korean actors. When questioned by WIRED, Binance did not address the North Korean hacking allegations, instead referring to a statement promising to cover all user losses and work with authorities.
Execution and Sophisticated Methods
According to TRM Labs, the operator deployed initial code early on October 29 and tested it on two wallets before rehearsing the final version on a third wallet and returning the test funds. Four hours after that rehearsal, the same code was installed on a Binance hot wallet, which are internet-connected wallets used by exchanges to handle customer withdrawals.
Rafe Pilling, senior director of threat intelligence at security company Sophos, told WIRED that these actors excel at infiltrating decentralized finance organizations. Chainalysis researchers stated that strong evidence emerged in real time when stolen funds from Binance commingled with assets from a previous exploit attributed to North Korean actors.
Binance stated that its initial investigation pointed toward a compromised engineer’s laptop, though subsequent reviews uncovered additional breach points, describing the incident as a complex attack. Elliptic’s Robinson observed that targeting crypto company staff, funding wallets through Tornado Cash, and rehearsing the attack in advance are hallmarks of the TraderTraitor group.
Asset Freezing and Laundering Tactics
Crypto firms and exchanges managed to freeze roughly half of the stolen funds to prevent hackers from moving or cashing out the money further. Robinson told WIRED that approximately $2.8 billion, representing about 44 percent of the total stolen amount and consisting almost entirely of stablecoins, has been frozen so far.
The remaining $3.3 billion primarily comprises Bitcoin, Ether, and XRP, which cannot be frozen and can only be intercepted if they reach an exchange or service. Chainalysis reported observing unprecedented money laundering patterns, with thousands of fast-processed transactions indicating the use of automation to obscure the trail of funds.
Binance has suspended all related services as part of its ongoing investigation and recovery efforts.
