On October 29, Binance suffered what could become the largest hack in the history of cryptocurrency. $6.3 billion vanished within hours, leaving the market in a state of shock.
Two leading blockchain analytics firms, Chainalysis and TRM Labs, quickly identified a suspect: TraderTraitor, a cybercriminal unit linked to North Korea — the same group already tied to the Bybit hack in 2025.
How was the attack orchestrated? What are the consequences for the market — and for Binance itself? Here is what we know.
A Surgical Attack Bearing TraderTraitor’s Signature
According to Chainalysis, funds began leaving Binance‘s hot wallets at 4:20 PM Eastern Time on October 29, across multiple blockchains simultaneously. The attacker had previously funded an operational wallet through Tornado Cash — the transaction mixer of choice for North Korean hackers — in order to submit signed authorizations enabling the execution of malicious code on the exchange’s hot wallets.
In under 20 minutes, $325 million in stablecoins was converted into $285 million worth of ETH, a deliberate move to evade the asset freezes that issuers such as Tether and Circle are able to trigger. The remaining $175 million was routed through intermediary wallets. The first freeze measures were not activated until 5:14 PM, giving the attacker nearly a full hour’s head start.
Binance states that its internal investigation points to a compromised engineer’s computer, which is believed to have granted access to a services container and enabled unauthorized withdrawals. The exchange confirmed it found no evidence of private key leakage — suggesting the attack targeted the application layer rather than the cryptographic infrastructure.
Markets Absorb the Blow: $1.5 Billion in Liquidations
The market reaction was immediate and brutal. Bitcoin dropped toward $76,000 during Friday morning trading before stabilizing around $77,400. The broader crypto market followed suit, with widespread losses across altcoins. In total, $1.5 billion worth of positions were liquidated: $468 million on the Bitcoin side, $358 million on Ethereum. Long positions — those betting on rising prices — absorbed the bulk of the losses.
The incident coincided with a separate attack on Polymarket, the decentralized prediction market platform, which suspended its international operations after a hacker drained more than $2.6 million from user accounts. This double wave of negative pressure amplified the sense of panic across the markets.
On the stablecoin issuer side, the response was coordinated: Tether froze $1.567 billion in USDT, Circle immobilized more than $800 million in USDC in coordination with law enforcement, and First Digital confirmed the freezing of stolen FDUSD. In total, Binance announced approximately $3 billion frozen on-chain.
Binance Says It Can Cover All Losses in Full
Despite the scale of the shock, Binance moved quickly to reassure its users and the broader market. The exchange stated it holds more than $6.34 billion in proprietary reserves to cover the incident — including approximately $5 billion in the assets directly affected. The remainder is being acquired through market channels and OTC desks.
Former CEO Changpeng Zhao, who is no longer at the helm but remains a major shareholder, confirmed on X: “It does look like a hack.” A measured statement that stands in sharp contrast to the typical crisis communications seen across the industry.
If the findings of Chainalysis and TRM Labs are confirmed, this hack would surpass the $1.5 billion theft suffered by Bybit in 2025 — also attributed to North Korean hackers — and would cement its place as the largest crypto theft in history. TraderTraitor, already responsible for hundreds of millions of dollars stolen in recent years, would confirm its status as a systemic threat to the global crypto ecosystem.
