Elliptic

Elliptic has attributed the Bybit theft to North Korea, based on various factors, including our analysis of the laundering of the stolen cryptoassets.

Within two hours of the theft, the stolen funds were sent to 50 different wallets, each holding approximately 10,000 ETH.

Elliptic's analysis shows that $6.43 billion in cryptoassets was stolen from Binance on October 29, 2026, more than four times the $1.46 billion stolen from Bybit in 2025.

It could be the biggest heist of any kind in history, according to Elliptic, a consultancy specialising in crypto-related crime. The incident, which took place late on Thursday, is more than four times bigger than the previous largest crypto hack, the $1.5bn one targeting the Bybit exchange last year . Elliptic says there does not appear to be anything comparable in the pre-crypto era.

The stolen USDT reached the attacker's main Ethereum wallet at 20:24 UTC. Tether froze that wallet 37 minutes later, locking 1.18 billion USDT in place, and then followed the funds, freezing four more attacker addresses within 17 minutes. Circle froze the 823 million USDC in the same wallet three minutes after that.

"This incident is almost certainly the single-largest-known theft of any kind," British blockchain analysts Elliptic said.

Elliptic estimated that $2.84 billion had been frozen by 7:00 am UTC on Friday, while the attackers still controlled around $3.33 billion in assets that issuers could not immobilize.

On October 30, the attacker began moving funds between blockchains. Between 11:38 and 12:29 UTC, they sold all of the stolen AVAX for USDC, bridged it to Ethereum using Circle's Cross-Chain Transfer Protocol (CCTP), and swapped it for 7,242.8 ETH.

Elliptic has verified $2.85 billion of frozen or seized funds, 44% of the theft, almost all of it USDT and USDC. The attacker is swapping the rest into ETH and other assets that cannot be frozen, and moving funds between blockchains, using automated scripts that run around the clock.

The Arbitrum Security Council took emergency action to move assets out of the attacker's reach, and on October 31 Optimism's governance appears to have done the same, moving 44 million OP (around $5 million) out of the attacker's address.

Stablecoins make up 94% of the frozen funds, almost entirely on Ethereum and Tron. Arbitrum and Optimism are the only blockchains where everything stolen has been secured, in both cases by the network's own governance. Nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen, because native assets have no issuer that can freeze them.

Before the freezes landed, the attacker converted around $786 million of stablecoins into ETH and TRX.

On Ethereum, 434 million USDT was swapped for 160,451 ETH through Uniswap, 1inch and market makers' request-for-quote systems. The swaps implied a loss of 12% to 26% against the market price, suggesting the attacker was prioritizing speed over value.

A second attacker wallet deposited 59.9 million USDT into Aave as collateral and borrowed 19,762 ETH, before Aave froze the affected markets. The loan is still open and close to the point of liquidation.

On Tron, 234 million USDT was swapped for 638 million TRX on SunSwap. On Ethereum, 48 million RLUSD was sold before Ripple froze the remainder, and around 150 other tokens were dumped for ETH on decentralized exchanges.

The 18,270 BTC has been split through a short peel chain into 19 addresses, most holding 1,000 BTC each. None of it has yet been sent to a service.

At current prices, the attacker now controls around $3.25 billion of assets that cannot be frozen by an issuer, spread across more than 800 addresses. This includes around 584,000 ETH ($1.32 billion), 18,327 BTC ($1.42 billion) and 233 million XRP.

Whether the automation involves AI agents, rather than conventional scripts, cannot be determined from the on-chain data.

The pattern of transactions suggests that much of the laundering was carried out by software rather than by hand.

Very few actors could coordinate an attack across 11 blockchains in around three hours.

This closely resembles the Bybit theft, in which North Korean hackers compromised a developer's machine at the wallet provider Safe{Wallet} and manipulated the transaction that Bybit's signers approved.

Teng added that the attack "was not carried out by one person"

Over the course of a few hours, the attacker drained Binance hot wallets across 11 blockchains.

The two sets of funds have now been combined in several wallets, and the amount has grown overnight. The link was first reported by ZachXBT.

Elliptic's total excludes a further $169 million that left Binance after withdrawals were suspended.

On October 29, 2026, $6.43 billion in cryptoassets were stolen from Binance, the world's largest cryptoasset exchange, according to Elliptic's analysis.

Elliptic has identified common service usage between those laundering the Binance funds and those behind three earlier thefts attributed to TraderTraitor, from BigONE, WOO X and AFX.

The long preparation, the apparent targeting of staff and the use of Binance's own systems to sign transactions resemble earlier TraderTraitor thefts, including Bybit.

The FBI has previously attributed the Bybit and DMM Bitcoin thefts to TraderTraitor.

Elliptic also cautioned that the onchain overlap with the Bitget incident involved only a small portion of the Binance funds and did not conclusively establish that the same attackers were responsible.

October 31, 22:41 UTC. About $196 million has been sent out of the main Tron distribution wallet to around 200 wallets,

The main Tron distribution wallet has sent funds every hour for 31 hours straight. The longest pause was 46 minutes, and there was no overnight break.

Swaps into THORChain use the same amounts again and again, with one value appearing 19 times.

On October 29, about $6.43 billion was stolen from Binance across 11 blockchains.

Download every address our investigators have linked to the Binance hack as a single CSV file.