Binance Hack: Tracing the $6.4B Theft to North Korea

Products

Crypto Investigations

Investigations Solutions

ReactorInvestigate and trace funds across blockchains

Wallet ScanCheck recovery seeds for seizable crypto

RapidInstant crypto triage with AI-powered insights

Crypto Compliance

Compliance Solutions

KYTMonitor transactions in real-time

SentinelUnderstand a stablecoins’s risk profile

Address ScreeningAssess a wallet’s risk exposure

VASP RiskingUnderstand the risk profile of a VASP

Fraud Prevention

AlteryaAI-powered fraud prevention

Crypto Data

Chainalysis Data Solutions (DS)Proactive threat intelligence and alerting

AI

Chainalysis agentsAI agents for blockchain intelligence

Platform

Blockchain IntelligencePower your blockchain technology needs with industry-leading intelligence

PlatformEnterprise ready infrastructure for blockchain analysis solutions

Chainalysis LabsOur R&D hub for the latest innovations

Industries

Law EnforcementDetect, disrupt, and deter crypto crime

Centralized ExchangesOptimize crypto exchange operations

Consumer BrandsStart your seamless transition into web3

CybersecurityProactive threat hunting and prevention

Financial InstitutionsGenerate new revenue opportunities with digital assets

National SecurityTarget and disrupt threat networks

Tax AgenciesAdminister and enforce digital asset tax policy

Stablecoin Risk ManagementCompliance-led growth for the stablecoin economy

RegulatorsProtect consumers and ensure market stability

Decentralized FinanceReduce risk and grow faster

Services

Global ServicesTailored, expert-led solutions to navigate crypto challenges and drive actionable results worldwide

Training & CertificationsEquip yourself with the knowledge needed to navigate cryptocurrency confidently

Chainalysis AcademyGet started with short training courses

Insights

Blog

Chainalysis Blog

Crime

Policy & Regulation

Crypto Basics

Markets

Company News

Research

ReportsResearch reports on crypto crime, regulation, and global activity

· 2026 Crypto Crime Report

· 2026 Geography of Crypto Report

Glossary

Events

WebinarsView upcoming and on-demand webinars from our experts and industry leaders

Chainalysis LinksThe digital asset event where the public and private sectors meet

Customers

CustomersHear why 1500+ customers trust Chainalysis

Podcast

Company

About

CompanyChainalysis is the blockchain data platform

Why ChainalysisTurn blockchain transactions into insights and risk into compliance

Careers

Careers at ChainalysisChainalysis is growing fast – join us today

US Government

Chainalysis Government SolutionsExpert crypto investigation and analytics for the US government

Network

PartnersEcosystem collaboration with industry partners

Login

Request a demo

This site requires JavaScript to function correctly.

Blog

Crime

Markets

Crypto Basics

Policy & Regulation

Company News

Search

Crime The $6.4 Billion Binance Hack: Tracing the North Korea Link

October 30, 2026 | Chainalysis Team

Key takeaways

Around 4:20 p.m. ET on October 29, 2026, funds began leaving Binance hot wallets across multiple blockchains. Unauthorized transfers totaled approximately $6.4 billion, the largest theft in crypto history.

Chainalysis attributes the hack to TraderTraitor, a North Korean cybercrime group. Stolen Binance funds commingled on-chain with funds from last month’s Bitget theft, which was attributed to North Korea.

Freezes began by 5:14 p.m. ET. About $2.8 billion has been frozen as of [time] ET.

The attacker swapped $325 million in stablecoins for $285 million in ETH over nearly 20 minutes to stay ahead of freezes.

Laundering shows signs of automation: thousands of transactions, with many addresses first receiving exactly 1 TRX.

How the Binance hack unfolded

Chainalysis investigators assess the $6.4 billion hack of Binance — the largest in the history of crypto, and one of the single-largest financial crimes of all time — to be the work of North Korean cybercrime group TraderTraitor. This group has repeatedly targeted the cryptocurrency industry, exchanges, DeFi protocols, and investors, to raise funds for the regime.

We base our intelligence assessment on on-chain activity observed in the hours following the hack.

From the beginning: Around 4:20 p.m Eastern Time on October 29, funds began leaving Binance hot wallets across multiple blockchains. On Ethereum, the attacker used an operational wallet funded through Tornado Cash to submit valid signed authorizations that allowed a Binance hot wallet to run attacker-deployed code. The attacker then called that wallet to sweep its assets into attacker-controlled addresses, while other affected Binance wallets appeared to send funds through ordinary signed transfers. Across the affected blockchains, the unauthorized transfers totaled approximately $6.4 billion USD.