- Blockchain analytics firms Chainalysis and TRM Labs have linked the breach of Binance hot wallets to the North Korean cybercrime syndicate Tradertraitor.
- Attackers deployed valid signed authorizations to run malicious software, using Tornado Cash funding and rapid stablecoin-to-ether swaps to beat issuer blacklists.
- Binance set aside over $6.34 billion in internal reserves to secure user assets, alongside an estimated $2.8 billion to $3 billion in frozen funds.
Blockchain forensics experts have uncovered intricate onchain maneuvers and technical exploits utilized in a major breach targeting cryptocurrency exchange Binance. Forensic investigators analyzing the transaction sequences revealed an automated pattern where multiple recipient wallets were initially seeded with exactly 1 TRX—Tron’s native token used to cover network transaction fees—before accepting larger sums and rapidly routing assets to subsequent destinations. Observing these recurrent flows between overlapping addresses, Chainalysis added: “This repeated sequence suggests a programmatic process for moving and redistributing the stolen funds.”
Breach Points and North Korean Attribution
Binance co-CEO Richard Teng confirmed that the perpetrators bypassed approval safeguards and exploited multiple breach points, ultimately triggering a self-destruct mechanism designed to erase software tools and forensic artifacts. Chainalysis documented that outflows began around 4:20 p.m. Eastern time on Oct. 29. The initial intrusion was traced to an Ethereum address funded via the privacy protocol Tornado Cash, which breaks transaction trails between deposits and withdrawals. By executing cryptographically signed permissions, this wallet prompted a Binance hot wallet to execute attacker-deployed software, directing transfers into external wallets controlled by the hackers.
The laundering architecture pointed directly toward state-sponsored activity. Initial analysis associated the illicit patterns with Tradertraitor, a notorious cybercrime syndicate backed by North Korea. Chainalysis observed assets taken from Binance intermingling with stolen funds stemming from the September attack on Bitget, which had previously been tied to North Korean threat actors. Reinforcing these conclusions, blockchain intelligence firm TRM Labs separately attributed the Binance intrusion to Tradertraitor with high confidence, drawing from a synthesis of onchain movements and offchain intelligence sources.
FBI Confirms North Korea Linked to $6B Binance Hack, Urges DeFi to Block Crypto Addresses
Rapid Stablecoin Liquidation Against Asset Freezes
Once the unauthorized transfers succeeded, the perpetrators engaged in a rapid effort to convert freezable tokens into decentralized digital assets. Unlike centralized stablecoins, which feature contract-level blacklist mechanisms that allow issuers to stop transfers from targeted addresses, native ether (ETH) contains no administrative freeze functionality. Chainalysis explained:
“Freezing funds takes time. The attacker attempted to stay ahead of that process by quickly moving $500 million of stablecoins into a wallet whose job it was to swap out those freezable assets to non-freezable assets.”
In an operation spanning nearly 20 minutes, the designated swap wallet converted $325 million of stablecoins into roughly $285 million in ether. Approximately 10 minutes later, the remaining $175 million in stablecoins was routed through intermediary wallets. Coordinated intervention began taking effect by 5:14 p.m. Eastern time on Oct. 29. Chainalysis accounted for roughly $2.8 billion in frozen assets by Oct. 30, while Binance estimated the total amount immobilized at approximately $3 billion on the same day.
Why This Matters
The scale of the attack and the tactics observed underscore the advancing capabilities of state-sponsored cyber rings like Tradertraitor, specifically their use of automated infrastructure to evade issuer-level blacklists before asset freezes can take effect. To neutralize the financial fallout and maintain platform solvency, Binance announced that it reserved over $6.34 billion in corporate funds to cover the incident, completely independent of the frozen funds. Of that allocation, $5 billion was already held in the affected tokens, while the exchange initiated market and over-the-counter purchases to procure the balance needed to fully match compromised user balances.
Frequently Asked Questions
Who was responsible for the Binance hot wallet breach?
Chainalysis and TRM Labs independently attributed the breach to Tradertraitor, a North Korean cybercrime syndicate, citing both offchain data and onchain asset mixing with proceeds from an earlier September theft at Bitget.
How did the hackers attempt to prevent their funds from being frozen?
The attackers moved $500 million in stablecoins into a specific conversion wallet, rapidly exchanging $325 million into ether over 20 minutes to evade centralized blacklist functions inherent to stablecoin smart contracts.
How much capital was recovered or reserved to cover losses?
Between $2.8 billion and $3 billion was successfully frozen across affected networks by Oct. 30. Additionally, Binance allocated more than $6.34 billion of its own company reserves to ensure all impacted tokens and user balances were fully accounted for.
