{"id":33332,"date":"2026-10-30T14:26:06","date_gmt":"2026-10-30T14:26:06","guid":{"rendered":"https:\/\/investx.fr\/en\/2026\/10\/30\/binance-6-billion-hack-north-korea-tradertraitor\/"},"modified":"2026-10-30T14:26:12","modified_gmt":"2026-10-30T14:26:12","slug":"binance-6-billion-hack-north-korea-tradertraitor","status":"publish","type":"post","link":"https:\/\/investx.fr\/en\/crypto-news\/binance-6-billion-hack-north-korea-tradertraitor\/","title":{"rendered":"Binance $6.3 Billion Hack: North Korea’s TraderTraitor Group Named as Prime Suspect"},"content":{"rendered":"\n

On October 29, Binance<\/strong> suffered what could become the largest hack in the history of cryptocurrency. $6.3 billion<\/strong> vanished within hours, leaving the market in a state of shock.<\/p>\n\n\n\n

Two leading blockchain<\/a> analytics firms, Chainalysis<\/strong> and TRM Labs<\/strong>, quickly identified a suspect: TraderTraitor<\/strong>, a cybercriminal unit linked to North Korea<\/strong> \u2014 the same group already tied to the Bybit<\/strong> hack in 2025.<\/p>\n\n\n\n

How was the attack orchestrated? What are the consequences for the market \u2014 and for Binance itself? Here is what we know.<\/p>\n\n\n\n

A Surgical Attack Bearing TraderTraitor’s Signature<\/h2>\n\n\n\n

According to Chainalysis<\/strong>, funds began leaving Binance<\/strong>‘s hot wallets at 4:20 PM Eastern Time<\/strong> on October 29, across multiple blockchains simultaneously. The attacker had previously funded an operational wallet through Tornado Cash<\/strong> \u2014 the transaction mixer of choice for North Korean hackers \u2014 in order to submit signed authorizations enabling the execution of malicious code on the exchange’s hot wallets.<\/p>\n\n\n\n

In under 20 minutes, $325 million in stablecoins was converted into $285 million worth of ETH<\/strong>, a deliberate move to evade the asset freezes that issuers such as Tether<\/strong> and Circle<\/strong> are able to trigger. The remaining $175 million was routed through intermediary wallets. The first freeze measures were not activated until 5:14 PM<\/strong>, giving the attacker nearly a full hour’s head start.<\/p>\n\n\n\n

Binance<\/strong> states that its internal investigation points to a compromised engineer’s computer<\/strong>, which is believed to have granted access to a services container and enabled unauthorized withdrawals. The exchange confirmed it found no evidence of private key leakage \u2014 suggesting the attack targeted the application layer rather than the cryptographic infrastructure.<\/p>\n\n\n\n

\"Binance<\/figure>\n\n\n\n

Markets Absorb the Blow: $1.5 Billion in Liquidations<\/h2>\n\n\n\n

The market reaction was immediate and brutal. Bitcoin<\/strong> dropped toward $76,000<\/strong> during Friday morning trading before stabilizing around $77,400<\/strong><\/a>. The broader crypto market followed suit, with widespread losses across altcoins. In total, $1.5 billion worth of positions were liquidated<\/strong>: $468 million on the Bitcoin side, $358 million on Ethereum. Long positions \u2014 those betting on rising prices \u2014 absorbed the bulk of the losses.<\/p>\n\n\n\n

The incident coincided with a separate attack on Polymarket<\/strong>, the decentralized prediction market platform, which suspended its international operations after a hacker drained more than $2.6 million<\/strong> from user accounts. This double wave of negative pressure amplified the sense of panic across the markets.<\/p>\n\n\n\n

On the stablecoin issuer side, the response was coordinated: Tether<\/strong> froze $1.567 billion in USDT<\/strong>, Circle<\/strong> immobilized more than $800 million in USDC<\/strong> in coordination with law enforcement, and First Digital<\/strong> confirmed the freezing of stolen FDUSD. In total, Binance<\/strong> announced approximately $3 billion frozen on-chain<\/strong>.<\/p>\n\n\n\n

Binance Says It Can Cover All Losses in Full<\/h2>\n\n\n\n

Despite the scale of the shock, Binance<\/strong> moved quickly to reassure its users and the broader market. The exchange stated it holds more than $6.34 billion in proprietary reserves<\/strong> to cover the incident \u2014 including approximately $5 billion in the assets directly affected. The remainder is being acquired through market channels and OTC desks.<\/p>\n\n\n\n

Former CEO Changpeng Zhao<\/strong>, who is no longer at the helm but remains a major shareholder, confirmed on X: “It does look like a hack.”<\/em> A measured statement that stands in sharp contrast to the typical crisis communications seen across the industry.<\/p>\n\n\n\n

If the findings of Chainalysis<\/strong> and TRM Labs<\/strong> are confirmed, this hack would surpass the $1.5 billion theft suffered by Bybit<\/strong> in 2025 \u2014 also attributed to North Korean hackers \u2014 and would cement its place as the largest crypto theft in history<\/a>. TraderTraitor<\/strong>, already responsible for hundreds of millions of dollars stolen in recent years, would confirm its status as a systemic threat to the global crypto ecosystem.<\/p>\n\n\n\n

\n\n\n\n

Related articles :<\/h3>\n\n\n\n