Investigators Point to North Korea's TraderTraitor in the $6.4 Billion Binance Hack as $2.85 Billion Is Frozen

What happened
The largest crypto theft on record now has a likely attribution. Blockchain investigators at TRM Labs, Chainalysis and Elliptic, along with on-chain investigator ZachXBT, have linked the roughly $6.3 to $6.4 billion Binance hack of October 29, 2026, to North Korea's TraderTraitor group, a subunit of the Lazarus Group. TRM attributed the attack to TraderTraitor with high confidence, citing on-chain and off-chain intelligence, while Chainalysis co-founder and CEO Jonathan Levin said the firm assessed the hack was likely done by the DPRK group TraderTraitor due to links to a previous hack. Elliptic's analysis, updated October 31, 2026, put the stolen total at $6.43 billion, more than four times the $1.46 billion stolen from Bybit in 2025, and said it believes it is likely TraderTraitor perpetrated the theft. No government has yet confirmed the attribution, and Binance itself has said only that it is working closely with law enforcement partners to confirm the identity of the criminals.

How the attack unfolded
According to TRM, an attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes. Elliptic's account describes the drain across 11 blockchains over a few hours, starting at approximately 20:05 UTC on October 29, when five Binance wallets on the XRP Ledger sent 233 million XRP to a single attacker-controlled address. Binance's initial investigation pointed to a compromised laptop belonging to a DevOps engineer, which gave the attacker access to the environment running internal services and then to unauthorised withdrawals. Binance later said its subsequent investigation uncovered additional points of breach in what it described as a complex attack, and that it found no evidence that the private keys used to approve transfers had been exposed. The specific attack path and cause remain under investigation.

What has been frozen, and what has not
Recovery is now a race between freezing and laundering. Binance said it worked with blockchain partners to freeze roughly $3 billion in affected assets, close to half the estimated amount taken. Elliptic verified $2.85 billion of frozen or seized funds, about 44% of the theft, almost all of it in USDT and USDC, which issuers can freeze. The rest is harder: the attacker is swapping the remainder into ETH and other assets that cannot be frozen, moving funds between blockchains using automated scripts that run around the clock. Arkham Intelligence data cited on October 30 put about $5.788 billion across 70 wallet addresses believed to belong to the attackers, including 1.768 billion USDT, 18,270 bitcoin, 497,976 ether and about 824.6 million USDC, as of 2:25 p.m. that day. Elliptic has attributed addresses associated with the theft so that customers and platforms can screen against them.

Why TraderTraitor fits the pattern
Several features of the attack match earlier North Korea-linked heists, according to TRM. ZachXBT noted that funds stolen from Binance and the earlier Bitget exploit were commingled at the same address after moving through THORChain, indicating the same actor was likely behind both incidents, and the Bitget attack had been attributed to TraderTraitor. The FBI has previously attributed the Bybit hack of February 2025 to North Korea and TraderTraitor, and US authorities have linked TraderTraitor to some of crypto's largest thefts, including more than $300 million taken from DMM Bitcoin in May 2024. The FBI says TraderTraitor targets company employees through social engineering. US government assessments link these thefts to funding North Korea's weapons programs, and Elliptic notes that actors linked to North Korea are believed to have stolen over $6.5 billion in cryptoassets in recent years, including more than $1 billion tracked in 2026 before the Binance incident.

What Binance has promised users
Binance has pledged to cover all losses, said deposits were unaffected, and said withdrawals were suspended while it completes a security revamp of the withdrawal service and related addresses, with resumption expected within 48 hours of its October 30 notice. The company also said it was beginning to recover assets for users. For users, the practical questions are timing and proof: when withdrawals resume, whether balances are fully intact, and whether the promised coverage applies without conditions. The October 30 sell-off that followed the hack, with Bitcoin falling about 5% in the early hours from around $80,000 to the $76,000 range, shows how quickly an exchange security event becomes a market-wide event, even when the exchange promises full coverage.

Lessons for every crypto holder
The Binance case reinforces security basics that apply far beyond one exchange. First, large balances should not sit on any single exchange: hardware wallets and self-custody remove the hot-wallet risk entirely. Second, social engineering is now the front door: TraderTraitor's known method is targeting employees, which means fake recruiter messages, job offers and software downloads are attack vectors for companies and individuals alike. Third, stablecoin freezing cuts both ways: it helped recover nearly half the Binance funds, but it also means USDT and USDC balances can be frozen by issuers, so diversification across assets and venues matters. Fourth, verify before trusting: check withdrawal addresses, enable hardware-key two-factor authentication, and treat any urgent message asking you to move funds as suspect until proven otherwise.

FAQ
Who is TraderTraitor? A North Korean hacking unit described by TRM as an elite subunit of the Lazarus Group, previously linked by the FBI to the Bybit hack and other major thefts.
How much was stolen from Binance? Binance estimated about $6.3 billion; Elliptic's analysis put it at $6.43 billion, the largest crypto theft on record.
How much has been frozen? About $2.85 billion verified frozen or seized by Elliptic, and roughly $3 billion frozen by Binance with partners, mostly in USDT and USDC.
Are Binance users covered? Binance has pledged to cover all losses, with deposits unaffected and withdrawals expected to resume within 48 hours of its October 30 notice. Users should still verify their own balances when access returns.
Has any government confirmed the attribution? No government has yet confirmed it; the attribution so far comes from blockchain intelligence firms and on-chain investigators.

Read more on Zimbuck: https://zimbuck.com/pages/zimbucknews and join the discussion at https://zimbuck.com/groups/zimbuckmarketnews .
This article is market news and general information only, not financial advice.