Over the last 18 hours, I have been asked hundreds, literally hundreds, of questions about the record $6.36 billion Binance hack by North Korea.
I wanted to share as many of the answers as possible here, with this community.
🚨 What happened?
About $6.36 billion left Binance wallets across ten blockchains, most of it in roughly 20 minutes starting at 20:05 UTC on October 29. It is the largest crypto theft on record, about four times the $1.5 billion Bybit hack.
🕵️ Who did it?
TRM Labs attributes the attack with high confidence to TraderTraitor, North Korea’s elite hacking unit, based on robust onchain and offchain intelligence. The FBI named the same group in the Bybit hack. This is important and new reporting – North Korea has now stolen about $12.8 billion in crypto since 2017, $7.4 billion of it this year.
⚡ How did it move so fast?
Preparation began at least 36 hours earlier, with small Tornado Cash withdrawals funding an operator wallet. The attacker tested and rehearsed the code, then pre-signed 50 authorizations on Ethereum so one would land. Wallets on ten chains, with different key types and signing schemes, produced valid signatures within about half an hour. TRM Labs‘ assessment points to a compromise of Binance’s hot wallet signing infrastructure, and the root cause remains under investigation.
🧊 What has been frozen?
This is a big part of the story. Nearly $2.7 billion, about 42 percent of the haul. Tether froze about $1.77 billion in USDT starting 37 minutes after the main sweep, and Circle froze about $825 million in USDC three minutes later. Ripple, World Liberty Financial and Arbitrum’s Security Council added the rest.
🏃 What is the attacker doing now?
The attacker is racing the clock. It sold about 325 million USDT to market makers at a discount of more than 10 percent and borrowed ETH against USDT on Aave to move value beyond issuers’ reach. About $2.4 billion in ETH and BTC remains with the attacker, and the Bitcoin is already splitting through a peel chain. Bridges, swap services and OTC brokers come next, and TRM is tracking every step through the Beacon Network.
🛡️ What should the industry do now?
Screen deposits and counterparties against the attacker addresses TRM has labeled. Alert on unexpected EIP-7702 delegations. Separate signing infrastructure by chain and wallet tier. Market makers should screen counterparties before filling large orders.
🌍 Why is this a national security story?
North Korea steals to fund weapons proliferation and destabilizing activity. Issuers, exchanges and investigators moving in hours shows how the industry pushes back together.
Much more to come.
