Chainalysis investigators have attributed the $6.4 billion hack of Binance, described as the largest in cryptocurrency history, to the North Korean cybercrime group TraderTraitor. The assessment relies on on-chain activity observed shortly after the breach began around 4:20 p.m. Eastern Time on October 29. Attackers utilized an operational wallet funded through Tornado Cash to submit valid signed authorizations, allowing a Binance hot wallet to execute attacker-deployed code and sweep assets into controlled addresses. Unauthorized transfers across multiple blockchains totaled approximately $6.4 billion.
The incident triggered a rapid response from stablecoin issuers, law enforcement, and industry partners to freeze funds before they could be converted into non-freezable assets. While attackers attempted to swap $325 million in stablecoins for ETH and move remaining funds to stopover wallets, freezes began by 5:14 p.m. Eastern Time. Chainalysis reports that approximately $2.8 billion has been frozen so far. The link to TraderTraitor was strengthened when stolen Binance funds were observed commingling with assets from a previous Bitget exploit attributed to North Korean actors. Current laundering patterns indicate the use of automation, with thousands of transactions circulating funds among addresses in a programmatic sequence.
This attribution underscores the persistent threat posed by state-sponsored cybercrime groups targeting centralized exchanges to fund regime operations. The scale of the theft highlights vulnerabilities in hot wallet security protocols, even at major platforms like Binance. However, the successful freezing of nearly half the stolen value demonstrates the effectiveness of coordinated industry responses involving blockchain analytics firms and stablecoin issuers. This event serves as a critical case study in the balance between decentralized asset immutability and centralized intervention capabilities.
The observation of automated laundering techniques signals an evolution in criminal tradecraft, moving beyond simple mixing services to complex, high-frequency transactional obfuscation. This requires exchanges and compliance teams to adapt their monitoring systems to detect programmatic patterns rather than just static address clusters. As investigations continue, the focus will likely shift to tracing the remaining unfrozen funds and assessing the long-term impact on user confidence and regulatory scrutiny regarding custody solutions.
