Chainalysis investigators assess the $6.4 billion hack of Binance — the largest in the history of crypto, and one of the single-largest financial crimes of all time — to be the work of North Korean cybercrime group TraderTraitor. This group has repeatedly targeted the cryptocurrency industry, exchanges, DeFi protocols, and investors, to raise funds for the regime.
We base our intelligence assessment on on-chain activity observed in the hours following the hack.
From the beginning: Around 4:20 p.m Eastern Time on October 29, funds began leaving Binance hot wallets across multiple blockchains. On Ethereum, the attacker used an operational wallet funded through Tornado Cash to submit valid signed authorizations that allowed a Binance hot wallet to run attacker-deployed code. The attacker then called that wallet to sweep its assets into attacker-controlled addresses, while other affected Binance wallets appeared to send funds through ordinary signed transfers. Across the affected blockchains, the unauthorized transfers totaled approximately $6.4 billion USD.
At this point the attacker was in a race against the clock. While billions of dollars in crypto under their control were denominated in unfreezable cryptocurrencies like Bitcoin and Ethereum, billions more were held in stablecoins like USDT and USDC that can be frozen. It was only a matter of time before the issuers of those stablecoins would freeze those funds — in coordination with law enforcement and industry partners such as Chainalysis.
Freezing funds takes time. The attacker attempted to stay ahead of that process by quickly moving $500 million of stablecoins into a wallet whose job it was to swap out those freezable assets to non-freezable assets. Over nearly 20 minutes it swapped $325 million in stablecoins into $285 million in ETH. Ten minutes later, the exploiter sent the remaining $175 million in stablecoins to stopover wallets, likely trying to move faster than a blacklist or freeze. But the industry caught up with them more quickly than they expected: by 5:14 pm eastern the freezes started.
Across multiple blockchains, Chainalysis investigators, law enforcement, stablecoin issuers, and other industry participants raced to freeze stolen funds before the attacker could convert them into assets beyond issuers’ control. Much of this work happened independently, with organizations acting in parallel. Chainalysis proactively shared investigative leads with industry partners to help identify and freeze stolen funds. Approximately $2.8 billion has been frozen so far. While that does not diminish the scale of the theft, the response shows an industry increasingly able to act quickly, both independently and together.
Commingled funds strengthen the link to TraderTraitor
Several laundering patterns initially suggested that TraderTraitor was responsible for the Binance theft. The strongest evidence emerged when Chainalysis investigators observed, in real time, funds stolen from Binance commingling with funds stolen in last month’s Bitget exploit, which had been attributed to North Korean actors. That direct on-chain link strengthened our assessment that TraderTraitor carried out the Binance hack and we announced it on October 30, 12:30am Eastern Time.
Laundering patterns suggest automation
As Chainalysis investigators continue to trace funds stolen from Binance, we are observing laundering patterns we have not seen before. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Many addresses follow a consistent pattern: they receive exactly 1 TRX, then receive additional funds, then forward funds to other addresses. This repeated sequence suggests a programmatic process for moving and redistributing the stolen funds.
The investigation continues
The investigation remains ongoing and we expect the stolen funds to continue moving in the coming days. Chainalysis is committed to supporting Binance and the wider industry as we trace the stolen funds, disrupt further laundering, and work to mitigate additional losses.
Crypto exchanges remain attractive targets for hackers because they hold substantial funds, regardless of where they operate. While this incident is unprecedented in scale, attacks on exchanges are not new. Every exchange should remain vigilant and prepared to respond quickly when an attack occurs.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.