Chainalysis and TRM Labs Link $6.3 B Binance Hack to North Korean Unit TraderTraitor

Blockchain analytics firms Chainalysis and TRM Labs have traced the $6.3 billion theft from Binance’s hot wallets to TraderTraitor, a unit tied to North Korea. The theft began on Oct. 29 when an attacker used a Tornado Cash‑funded operational wallet to sign authorizations that allowed code deployed on a Binance hot wallet to move funds. Over roughly 20 minutes the attacker swapped $325 million in stablecoins for $285 million in ETH, then transferred the remaining $175 million to stop‑over addresses. Binance’s investigation points to a compromised engineer’s laptop that granted access to a service container, with no evidence of a private‑key leak. Binance says it has frozen about $3 billion on‑chain and holds a reserve of more than $6.34 billion, roughly $5 billion of which is in the affected token assets. The hack triggered a market sell‑off: Bitcoin fell to around $76,000, total market liquidations hit $1.5 billion (Bitcoin $468 million, Ether $358 million), and stablecoin issuers Tether, Circle, and First Digital froze more than $1.567 billion, $800 million, and the FDUSD stolen, respectively. The incident is the largest crypto hack on record if the figures hold.