Key Takeaways
- TRM Labs attributed the $6.3 billion Binance exploit to TraderTraitor, a North Korean hacking unit within the Lazarus Group.
- The attackers transferred the majority of stolen assets across ten different blockchains within approximately 20 minutes on October 29.
- Stablecoin issuers Tether and Circle immobilized roughly $2.4 billion, while Binance confirmed a total of $3 billion in frozen assets.
- Binance committed to compensating affected users and anticipates restoring withdrawal services within a 48-hour window.
- The cryptocurrency market experienced $1.53 billion in forced liquidations over 24 hours as Bitcoin dropped to approximately $76,460.
Cryptocurrency security researchers have traced a massive $6.3 billion Binance security breach to the Lazarus Group, a notorious North Korean state-sponsored hacking organization. The incident occurred on October 29 and represents the most significant cryptocurrency theft ever recorded, according to security firm Blockaid.
Blockchain intelligence company [[LINK_START_0]]TRM Labs[[LINK_END_0]] reported with high confidence that the attack originated from TraderTraitor, a specialized North Korean cyber unit operating under the Lazarus umbrella. Independent blockchain analyst ZachXBT similarly identified Lazarus as the primary suspect, though Binance itself has not officially attributed the attack.
The FBI had previously identified TraderTraitor as the perpetrator behind February 2025’s Bybit compromise, which resulted in approximately $1.5 billion in stolen digital assets. According to U.S. intelligence agencies, North Korea systematically targets cryptocurrency platforms to generate revenue for its prohibited weapons development initiatives.
Timeline and Mechanics of the Attack
TRM’s forensic analysis revealed that approximately $6.36 billion exited Binance custody wallets across ten separate blockchain networks, encompassing Ethereum, Bitcoin, Tron, Solana, and the XRP Ledger. The bulk of these unauthorized transfers occurred within a concentrated 20-minute period beginning at 20:05 UTC.
Ethereum alone accounted for roughly $3.79 billion in stolen funds. Bitcoin and Tron networks saw $1.47 billion and $628 million respectively. Additionally, attackers withdrew approximately 233.46 million XRP tokens, valued at nearly $296 million, from five separate Binance wallets before initiating the Ethereum phase of the operation.
According to TRM’s investigation, the groundwork for this exploit began at least 36 hours before execution. A wallet under attacker control received multiple small-value withdrawals from Tornado Cash and conducted trial runs of malicious smart contract code.
Blockaid’s technical analysis identified an Ethereum transaction containing 50 EIP-7702 authorization signatures targeting Binance 14, one of the exchange’s highest-volume hot wallets. Only a single authorization succeeded, but it granted a malicious smart contract complete control over the wallet’s contents.
“The attacker effectively reprogrammed a major Binance Ethereum hot wallet so that a single operator could drain it, including any new money deposited into it,” Blockaid CEO Ido Ben-Natan explained to crypto.news. This compromised wallet alone surrendered approximately $2.5 billion in assets.
Binance’s preliminary internal investigation suggests the security breach originated from a compromised laptop assigned to a DevOps engineering team member. The exchange emphasized that its investigation has uncovered no indication of exposed private key material.
Stablecoin issuer Tether immobilized more than 1.567 billion USDT, while Circle froze in excess of 800 million USDC. Binance confirmed that approximately $3 billion in total assets have been frozen through coordinated efforts.
Onchain Lens tracking data indicates the attacker currently retains control of approximately 480,720 ETH, valued at roughly $1.08 billion, which cannot be frozen by any centralized issuer. The attacker has recently transferred 17,260 ETH to a newly created wallet address.
Binance has committed to fully compensating affected customers using its SAFU reserve fund and additional corporate capital. The platform continues accepting deposits, but has temporarily suspended all withdrawals while security infrastructure undergoes comprehensive upgrades, with services expected to resume within 48 hours.
Market Turbulence Triggers Wave of Liquidations
Cryptocurrency traders experienced $1.53 billion in forced position closures over a 24-hour period, according to data aggregator CoinGlass. Long positions represented approximately $1.29 billion, comprising 83.8% of total liquidations.
Bitcoin-related positions accounted for roughly $499 million in forced closures, with ether following at $358 million. Binance’s platform alone registered $754.6 million, representing 49.2% of all liquidation activity across exchanges.
Bitcoin’s price declined to approximately $76,460, approaching its 200-day moving average of $76,457. Ether fell beneath the $2,200 threshold, while Bitcoin is tracking toward an approximately 8% monthly decline.
Market analysts identified support at the $75,545 level, with the next significant support zone at $70,000.
Prices have subsequently begun recovering, with Bitcoin advancing toward $78,500 and ether trading near $2,240. During the most recent hour, short positions constituted $20.6 million of $21.6 million in liquidation volume.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
