Independent record. Not associated with, endorsed by or operated by Binance. We will never ask you to connect a wallet, log in or pay to recover funds.

All claims

TRM said Circle froze the 823 million USDC in the main receiving wallet at 21:04 UTC, in coordination with law enforcement.

This line is our short summary of the quote below. The quote is the evidence.

ReportedfreezeClaim 144

Circle froze the 823 million USDC in the main receiving wallet at 21:04 UTC, in coordination with law enforcement.

Speaker
TRM Labs
Publisher
TRM Labs (Analytics firm)
Original
North Korea Steals USD 6.36B from Binance in the Largest Hack in History
Captured
Archived copy
sha256 451c3280c64e
Event time
Published

On the timeline

Figures from this claim

Other claims from the same source

Reportedroot causeClaim 458

TRM Labs said that on the nine chains other than Ethereum, Binance wallets sent funds to the attacker through ordinary signed transfers.

Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers.

Speaker
TRM Labs
Publisher
TRM Labs (Analytics firm)
Original
North Korea Steals USD 6.36B from Binance in the Largest Hack in History
Captured
Archived copy
sha256 451c3280c64e
Published
Reportedroot causeClaim 303

TRM Labs said early indicators suggested the attacker had phished the Ethereum authorizations, but that this leaves the other chains unexplained.

Early indicators on the Ethereum activity suggested the attacker had phished the authorizations. That explanation covers Ethereum and leaves the other chains unexplained.

Speaker
TRM Labs
Publisher
TRM Labs (Analytics firm)
Original
North Korea Steals USD 6.36B from Binance in the Largest Hack in History
Captured
Archived copy
sha256 451c3280c64e
Published
ReportedattributionClaim 302

TRM Labs attributed the attack to TraderTraitor, which it called North Korea's elite hacking unit, with high confidence.

North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence.

Speaker
TRM Labs
Publisher
TRM Labs (Analytics firm)
Original
North Korea Steals USD 6.36B from Binance in the Largest Hack in History
Captured
Archived copy
sha256 451c3280c64e
Published
Reportedroot causeClaim 301

TRM Labs said preparation began at least 36 hours before the theft, with the operator wallet receiving three small Tornado Cash withdrawals from the morning of 28 October.

Preparation began at least 36 hours before the theft. The attacker's operator wallet received three small withdrawals from Tornado Cash, a service that obscures where crypto comes from, starting the morning of October 28.

Speaker
TRM Labs
Publisher
TRM Labs (Analytics firm)
Original
North Korea Steals USD 6.36B from Binance in the Largest Hack in History
Captured
Archived copy
sha256 451c3280c64e
Published
ReportedfreezeClaim 243

Binance co-CEO Yi He said Ripple helped stop about USD 200 million from moving; TRM reports a 40.5M RLUSD freeze; the sources do not say whether the figures measure the same thing.

Binance co-CEO Yi He said Ripple helped stop about USD 200 million from moving; TRM has confirmed the 40.5 million RLUSD freeze onchain.

Speaker
Yi He
Publisher
TRM Labs (Analytics firm)
Original
North Korea Steals USD 6.36B from Binance in the Largest Hack in History
Captured
Archived copy
sha256 451c3280c64e
Published

Reviewer note: Yi He's figure is Binance's side of a disagreement: TRM confirmed 40.5 million RLUSD frozen on-chain.