Chainalysis says Binance hackers used automated money-laundering patterns not seen before; Elliptic: almost all of the $6.3B was taken in the first 30 minutes (Financial Times)

Washington, Oct. 30 - North Korean hackers allegedly pilfered approximately US$6.36 billion in cryptocurrency from Binance, the globe's premier cryptocurrency exchange, marking the most substantial cryptocurrency heist ever recorded, according to a U.S. blockchain intelligence firm. TRM Labs posited Thursday's assault on Binance was most likely orchestrated by TraderTraitor, a North Korean hacking collective, which siphoned digital assets from Binance across 10 blockchain networks.

The majority of the funds were extracted within a span of 20 minutes, TRM Labs reported. The agency expressed a "high confidence" that the group was culpable for the breach, basing its assessment on the scrutiny of cryptocurrency transactions and resemblance to preceding North Korean hacking campaigns. TRM Labs suggested the hackers commenced preparations for the attack at least 36 hours prior.

The firm posited they infiltrated systems responsible for authorizing cryptocurrency transfers, thereby enabling them to transfer funds without authorization. TRM Labs estimated that around $2.7 billion in stolen assets had been frozen through collaboration among cryptocurrency firms and blockchain operators. Nonetheless, the hackers continued to control roughly $2.4 billion worth of Bitcoin and Ethereum, two prominent cryptocurrencies.

TRM Labs cautioned that the hackers may endeavor to obscure the provenance of the stolen funds by transferring them across various blockchain networks and cryptocurrency trading platforms. The assault would substantially surpass the $1.5 billion looted from cryptocurrency exchange Bybit in February 2025, which the U.S. Federal Bureau of Investigation linked to TraderTraitor.

U.S. officials have previously noted that North Korea leverages networks of its nationals overseas and foreign-based intermediaries, encompassing China, Russia, Cambodia, and Vietnam, to launder stolen digital assets into conventional currency for procurement ventures and to finance its weapons of mass destruction endeavors.