Metric | Value |
|---|---|
Funds stolen | $6.43B |
Funds frozen | $2.85B |
Unfreezable assets held by attacker | $3.21B |
BTC stolen | 18,270 |
ETH held by attacker | 519,104 |
The FBI attributed the theft of more than $6B from Binance to North Korea's TraderTraitor group on October 31, confirming earlier assessments from Chainalysis and Elliptic. The attacker still controls $3.21B in assets that no issuer can freeze.
What the FBI confirmed
According to Elliptic's update, the FBI has observed the actors converting stolen assets primarily into ETH ahead of further laundering through DeFi and instant swap services.
Chainalysis had announced its attribution at 12:30 a.m. ET on October 30, after investigators watched Binance funds commingle in real time with proceeds of September's Bitget exploit, already attributed to North Korea.
- Elliptic found common service usage between the Binance launderers and three earlier TraderTraitor thefts: BigONE, WOO X and AFX
- On Ethereum, the attacker abused EIP-7702 delegation with 50 authorizations validly signed with the Binance 14 hot wallet key
- Binance says the attack involved additional points of breach and was not carried out by one person
Stolen versus frozen
Metric | Value |
|---|---|
Total stolen (Elliptic) | $6.43B |
Stablecoins stolen | $3.46B |
Frozen or seized | $2.85B (44%) |
USDT frozen by Tether in the first wallet | $1.18B |
USDC frozen by Circle | $823M |
Unfreezable assets held by attacker | $3.21B |
Freezes began at 5:14 p.m. ET on October 29, under an hour after funds started leaving Binance hot wallets, per the Chainalysis report. Nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR could be frozen.
Laundering runs on scripts
Chainalysis describes laundering patterns it has not seen before: thousands of transactions in a short window, funds sent back to earlier addresses, and a repeated template where addresses receive exactly 1 TRX before receiving and forwarding funds.
- The main Tron laundering wallet has sent 546 transfers, with a median gap of 96 seconds and a longest pause of 39 minutes
- 434M USDT was swapped for 160,451 ETH via Uniswap, 1inch and market makers, at a 12% to 26% loss to market price
- The 18,270 BTC was split into 19 addresses, most holding 1,000 BTC each; none has been sent to a service yet
- XRP, SOL and NEAR worth $437M have not moved since the theft
What it means for you
Binance said it will cover all losses from its SAFU fund and company funds, has reserved more than $6.34B to do so, and plans a full Proof of Reserves report by Monday. Co-CEO Richard Teng said on October 30 he was hopeful withdrawals would resume before Sunday.
If you run a protocol or a compliance desk, Chainalysis and Elliptic have labelled the attacker's addresses and their customers can screen for exposure. Tether has already begun blacklisting Tron addresses receiving funds from the laundering chain.
On Aave, the attacker holds an open position with 59.9M USDT as collateral against 19,762 ETH borrowed, close to liquidation after the protocol froze the affected markets.