TL;DR
Get business pricing on networking and server gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TRM Labs says attackers moved most of roughly $6.3 billion in cryptocurrency from Binance wallets in about 20 minutes on October 29. Binance and other firms have frozen an estimated $2.8 billion, while investigators have not publicly confirmed who carried out the attack.
Attackers stole roughly $6.3 billion in cryptocurrency from wallets belonging to Binance on October 29, with most of the funds moved in about 20 minutes, according to analysis by tracing firm TRM Labs reported by WIRED. Binance suspended deposits and withdrawals after the incident, and crypto firms have frozen an estimated $2.8 billion; no public attribution by Binance or law enforcement has established who was responsible.
TRM Labs says the attackers drained Binance wallets across at least 10 blockchains, including Ethereum, Bitcoin, Tron and Solana. The stolen assets were sent to multiple addresses controlled by a single attacker, according to the firm’s analysis. Binance’s wallets included hot wallets, which are internet-connected and used by exchanges to process transactions such as customer withdrawals.
The speed of the transfers was part of a longer operation, according to TRM. The firm says preparations began at least 36 hours before the theft, involving small test withdrawals, tests of attack code on wallets and a rehearsal. TRM says the final code was installed on a Binance hot wallet about four hours after the rehearsal.
Binance said it would cover losses from the incident and was working with law enforcement. The company initially suspected a compromised laptop, but said its later investigation found additional points of breach. The source report does not specify how the additional access points were identified or describe the complete technical path used to reach the wallets.
Billions Still at Risk of Movement
The scale of the theft and the short time in which most funds were moved leave investigators and crypto firms racing to trace assets across multiple networks. Freezing funds can prevent some tokens from being transferred or cashed out, but it does not mean all stolen assets are recoverable. WIRED reported that an estimated $2.8 billion, or about 44 percent of the stolen amount, had been frozen, mostly in stablecoins.
Much of the remaining $3.3 billion was described as mostly Bitcoin, which may be harder for service providers to freeze. Chainalysis said it was seeing laundering patterns it had not encountered before and described thousands of rapidly processed transactions, which it said indicated automation to obscure the funds’ trail. The firms’ estimates and assessments may change as tracing continues.
The incident also highlights the potential consequences of a breach affecting exchange hot wallets: funds can move quickly across networks before firms can coordinate responses. Binance said it would cover the losses, but the source material does not provide details on how that commitment will be implemented or when customers might be affected.
Products Worth Considering
Bose QuietComfort Wireless Noise Cancelling Headphones, Sandstone
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 1TB SSD, and 12MP Center Stage camera (Midnight)
As an affiliate, we earn on qualifying purchases.
Tracing Firms Assess Possible Links
TRM Labs and Chainalysis have linked the attack to TraderTraitor, a hacking group associated with North Korea, based on their analysis of on-chain and off-chain activity. Elliptic’s chief scientist Tom Robinson said the firm considered North Korean responsibility likely, while noting that Elliptic had not specifically tied the incident to TraderTraitor. These are assessments by private tracing and security firms, not a public finding by Binance or law enforcement.
Chainalysis said one of its strongest indicators was seeing funds stolen from Binance mix with funds from a recent Bitget exploit that it had attributed to North Korean actors. Elliptic also cited reported use of Tornado Cash and advance rehearsals as similarities to earlier attacks. Such overlaps can inform attribution, but the available reporting does not establish the identity of the attacker.
North Korean hacking groups have repeatedly been linked by investigators to cryptocurrency thefts. The FBI previously named TraderTraitor in connection with the $1.5 billion Bybit hack, according to the source report. That history is relevant to investigators’ current hypotheses, but it does not by itself confirm responsibility for the Binance theft.
““We think North Korea is likely responsible.””
— Tom Robinson, chief scientist and co-founder of Elliptic
Attribution and Recovery Remain Open
Responsibility has not been publicly confirmed by Binance or law enforcement. TRM Labs and Chainalysis have assessed a possible TraderTraitor connection, and Elliptic has said North Korean involvement is likely, but these remain private firms’ analytical conclusions rather than an official attribution.
The final amount recovered or frozen is also unsettled. The reported figure of about $2.8 billion frozen is an estimate from the response period described in the source report; the status of the remaining funds may change. It is not clear how much of the unfrozen cryptocurrency can ultimately be tracked, blocked or recovered.
Binance has not publicly detailed the full breach method. Its statement referred to a suspected compromised laptop and later-discovered additional breach points, but the reporting does not explain the role of each point or identify the affected personnel and systems.
Investigators Continue Tracing Funds
Binance says it is coordinating with law enforcement and working to identify those responsible. Crypto exchanges and tracing firms are continuing to monitor the stolen assets and seek opportunities to freeze funds as they move. The next meaningful updates are likely to concern changes in the amount frozen, any recovery of assets, and whether investigators issue a public attribution.
Until Binance or authorities release further findings, the timing and transfer path reported by TRM and the possible North Korean link remain distinct claims: the former is based on blockchain analysis, while the latter is an attribution assessment that has not been officially confirmed.
Key Questions
How much cryptocurrency was stolen from Binance?
The source report puts the amount at roughly $6.3 billion across multiple cryptocurrencies and blockchains.
How quickly did the theft happen?
TRM Labs says most of the stolen funds were moved in about 20 minutes on October 29. The firm also says preparations began at least 36 hours earlier.
How much of the stolen cryptocurrency has been frozen?
Elliptic’s Tom Robinson estimated that about $2.8 billion, or 44 percent of the total, had been frozen at the time covered by the report. The estimate may change as tracing continues.
Has North Korea been confirmed as responsible?
No. TRM Labs and Chainalysis have assessed a possible connection to TraderTraitor, and Elliptic said North Korean involvement was likely. Binance and law enforcement had not publicly confirmed that attribution in the reporting.
Source: wired.com
