Chainalysis

Funds from the Bybit exploit have also consolidated in addresses holding funds from other known DPRK-linked attacks, providing further evidence that the nation state actors are behind this latest incident.

This attack highlights a common playbook used by the DPRK: orchestrating social engineering attacks and employing intricate laundering methods in an attempt to move stolen funds undetected.

Around 4:20 p.m. ET on October 29, 2026, funds began leaving Binance hot wallets across multiple blockchains. Unauthorized transfers totaled approximately $6.4 billion, the largest theft in crypto history.

But the industry caught up with them more quickly than they expected: by 5:14 pm eastern the freezes started.

Stablecoin issuers began freezing funds by 5:14 p.m. ET on October 29

Chainalysis said its current estimate of the amount stolen from Binance is $5.912 billion at the time of theft, four times the amount stolen from crypto exchange Bybit in 2025.

Our current estimate on amount stolen is approx $5.912B at time of theft

That direct on-chain link strengthened our assessment that TraderTraitor carried out the Binance hack and we announced it on October 30, 12:30am Eastern Time.

Chainalysis attributes the hack to TraderTraitor, a North Korean cybercrime group.

Approximately $2.8 billion has been frozen so far.

Over nearly 20 minutes it swapped $325 million in stablecoins into $285 million in ETH.

Many addresses follow a consistent pattern: they receive exactly 1 TRX, then receive additional funds, then forward funds to other addresses.

This repeated sequence suggests a programmatic process for moving and redistributing the stolen funds.

The strongest evidence emerged when Chainalysis investigators observed, in real time, funds stolen from Binance commingling with funds stolen in last month’s Bitget exploit, which had been attributed to North Korean actors.

“Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit,” the company said . “Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds.”

Chainalysis said the incident is "not related to the recent crypto theft at Binance."

The firm has also been tracking funds stolen in Binance’s separate multibillion-dollar hack, saying the attackers are using automation to obscure the trail and leveraging DeFi protocols on Tron to dodge stablecoin freezes.