Markets · Markets
Chainalysis ties Binance attack to North Korea, estimates $6.4 billion moved
The blockchain analytics firm names the TraderTraitor group, citing on-chain links to last month's Bitget attack. Binance has not named a culprit.
Chainalysis, the blockchain analytics firm, said in a blog post at 5:34 a.m. ET on Friday that its investigators "assess the $6.4 billion hack of Binance ... to be the work of North Korean cybercrime group TraderTraitor," an assessment the post says it first announced at 12:30 a.m. ET [1]. By Chainalysis's count, "the unauthorized transfers totaled approximately $6.4 billion USD," and "approximately $2.8 billion has been frozen so far" [1]. Binance, in the posts Le Coin has reviewed, has not named North Korea or anyone else as responsible and has not responded to the attribution [2][3]. Neither OFAC, the Treasury office that handles sanctions, nor the FBI had issued a statement on it as of Friday morning [5].
Le Coin's earlier coverage: Binance pauses withdrawals after attack and Binance says it has begun recovering users' assets.
The mechanism
Chainalysis describes the attack as a misuse of permission rather than a broken lock. According to the post, "the attacker used an operational wallet funded through Tornado Cash to submit valid signed authorizations that allowed a Binance hot wallet to run attacker-deployed code" [1]. A hot wallet is an exchange wallet kept online so it can pay out withdrawals quickly. Tornado Cash is a mixing service, a tool that pools many users' coins so that individual transfers are hard to trace.
Chainalysis puts the start at "around 4:20 p.m Eastern Time on October 29," when "funds began leaving Binance hot wallets across multiple blockchains" [1]. It then traces fast conversion. The attacker was "quickly moving $500 million of stablecoins into a wallet," Chainalysis says, and "over nearly 20 minutes it swapped $325 million in stablecoins into $285 million in ETH," then "sent the remaining $175 million in stablecoins to stopover wallets" [1]. Stablecoins are tokens pegged to the dollar. Figure 3 shows those amounts as Chainalysis states them. Chainalysis says that "by 5:14 pm eastern the freezes started" [1]. At 6:33 p.m. Binance said "Withdrawals will resume" after "security checks" [4]; it said deposits and withdrawals were "temporarily suspended" at 8:13 p.m. [6].
The evidence
Chainalysis rests its attribution on one main link. It says funds taken from Binance were found mixing with funds taken in "last month's Bitget exploit, which had been attributed to North Korean actors," and that this "direct on-chain link strengthened our assessment that TraderTraitor carried out the Binance hack" [1]. That framing is Chainalysis's; the post does not say who attributed the Bitget attack to North Korea, and Le Coin has not independently checked that earlier attribution.
Chainalysis also says "Thousands of transactions in a short period suggest that the attackers are using automation" [1]. "Many addresses follow a consistent pattern: they receive exactly 1 TRX, then receive additional funds, then forward funds to other addresses," the post says [1]. TRX is the native token of the Tron blockchain.
Figure 1 puts the two sides' numbers next to each other. They are different measures, and Le Coin does not reconcile them. Chainalysis counts "unauthorized transfers" of about $6.4 billion [1]. Binance said at 10:24 p.m. Thursday that "the estimated total impact sits at around $6.3B," with "~$3 billion frozen on-chain so far" [2]. Chainalysis's frozen figure, about $2.8 billion, is roughly $0.2 billion lower than Binance's; the two were stated at different times, and neither explains the gap [1][3]. At 6:55 a.m. Friday Binance said it "has already reserved over $6.34B of company funds to cover this incident," and that those figures "do not include frozen or protected assets" [3]. That reserve is a commitment from Binance's own balance sheet, not proof that users have been made whole.
| Measure | Who says it | US$ bn | Their words |
|---|---|---|---|
| Total | Chainalysis | about 6.4 | "unauthorized transfers" |
| Total | Binance | about 6.3 | "estimated total impact" |
| Frozen | Chainalysis | about 2.8 | "frozen so far" |
| Frozen or protected | Binance | about 3.0 | "$3bn has been frozen" |
| Reserved company funds | Binance | over 6.34 | "reserved over $6.34B of company funds" (a commitment, not proof of recovery) |
Chainalysis [1]; @binance [2][3]
Figure 2 sets out the timeline each party gives.
| Date | Time (ET) | Event | Source |
|---|---|---|---|
| Oct. 29 | ~4:20 p.m. | Funds begin leaving Binance hot wallets | Chainalysis |
| Oct. 29 | 5:14 p.m. | Freezes start | Chainalysis |
| Oct. 29 | 6:33 p.m. | "Withdrawals will resume" after "security checks" | Binance |
| Oct. 29 | 8:13 p.m. | Deposits and withdrawals "temporarily suspended" | Binance |
| Oct. 29 | 10:24 p.m. | ~$6.3B "estimated total impact"; ~$3B frozen | Binance |
| Oct. 30 | 12:30 a.m. | Announces TraderTraitor assessment (per its blog) | Chainalysis |
| Oct. 30 | 5:34 a.m. | Blog post on TraderTraitor assessment | Chainalysis |
| Oct. 30 | 6:55 a.m. | Over $6.34B company funds reserved | Binance |
Chainalysis [1]; @binance [2][3][4][6]
The objection
Chainalysis's case may be right. Naming a group early helps exchanges and token issuers flag and freeze funds tied to it, and Chainalysis says it will "update labels as new information emerges" [1].
But the post is, in its own words, an "intelligence assessment" based "on on-chain activity observed in the hours following the hack" [1]. It gives no confidence level, publishes no addresses or transaction records, and says "the investigation remains ongoing" [1]. Its key link depends on an earlier attribution whose source it does not name. Its page carries a disclaimer that Chainalysis "does not guarantee or warrant the accuracy, completeness, timeliness" of the content, and it closes with a pitch for Chainalysis products [1]. Its description of the attack as "the largest in the history of crypto, and one of the single-largest financial crimes of all time" is Chainalysis's claim, not Le Coin's [1].
The tell (Le Coin's view)
The attribution matters less for who did it than for what happens to the frozen money. If U.S. authorities back the North Korea finding, freezes become easier to defend and harder to unwind; if they stay silent, Chainalysis's name on the attack remains a private firm's judgment. Watch for three things: a statement from OFAC or the FBI, Binance naming or declining to name a culprit, and whether the frozen figures from Chainalysis and Binance converge. Binance's reserve covers its own loss estimate either way [3], so the attribution changes recovery odds, not the size of the hole.
Stop
Chainalysis says North Korea's TraderTraitor moved about $6.4 billion out of Binance. Binance has not said who did it.
Sources
- Chainalysis, "The $6.4 Billion Binance Exploit: Tracing the North Korea Link," Oct. 30, 5:34 a.m. ET (modified 6:41 a.m. ET): https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/
- @binance, Oct. 29, 10:24 p.m. ET, post 2115993138271756507 (edited version 2115993361517891592 at 10:25 p.m.): https://x.com/binance/status/2115993138271756507
- @binance, Oct. 30, 6:55 a.m. ET, post 2116121748555153621: https://x.com/binance/status/2116121748555153621
- @binance, Oct. 29, 6:33 p.m. ET, post 2115935002139742437: https://x.com/binance/status/2115935002139742437
- OFAC recent actions (https://ofac.treasury.gov/recent-actions) and FBI press releases (https://www.fbi.gov/news/press-releases), checked Oct. 30 about 9:15 a.m. ET by Le Coin's data desk; no Binance item.
- @binance, Oct. 29, 8:13 p.m. ET, post 2115960292115124558: https://x.com/binance/status/2115960292115124558
Holding the Corner.
Not financial advice.