Binance Vows Full Compensation After $6.3 Billion Crypto Heist, North Korea's TraderTraitor Suspected

Binance, the world's largest cryptocurrency exchange, suffered the biggest crypto theft on record on Thursday after hackers stole approximately $6.36 billion (approximately Rs 56,500 crore) from its wallets across 10 blockchains. Blockchain intelligence firm TRM Labs has attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking group, although Binance has not publicly named the perpetrators and no government has formally confirmed responsibility.

Most funds were stolen within 20 minutes, beginning at 20:05 UTC, followed by another wave around 23:05 UTC targeting wallets on Avalanche and Polygon. TRM estimates the theft was four times larger than the $1.5 billion Bybit hack of February 2025. The stolen amount represents around 4 per cent of Binance's $144 billion in pre-hack assets, according to DefiLlama.

TraderTraitor is the US authorities' name for North Korean cyber operations targeting cryptocurrency companies. Identified in a 2022 advisory by the FBI, CISA and Treasury Department, it is associated with the wider Lazarus Group, linked to the 2014 Sony Pictures hack. Security firms also track it as Jade Sleet, UNC4899 and Slow Pisces. US authorities have accused North Korean hackers of stealing cryptocurrency to finance the country's weapons programmes.

The group typically uses phishing and social engineering, targeting IT, DevOps and system administration employees through fake recruitment approaches on LinkedIn, Slack and Telegram. Its previous operations include Japan's 308millionDMMBitcointheft,JumpCloud,Alphapo(60 million), CoinsPaid (37 million)and Atomic Wallet(100 million). In February 2025, it was officially linked by the FBI to the Bybit heist involving 401,346 ETH worth approximately $1.4 billion.

Investigators suspect TraderTraitor in the Binance attack because of similarities with the Bybit and KelpDAO hacks. TRM found preparations began at least 36 hours before the theft, with three small Tornado Cash withdrawals funding an operator wallet on October 28, followed by code testing and rehearsals. Chainalysis also assessed that TraderTraitor was likely responsible, while investigator ZachXBT pointed towards Lazarus. However, the attribution remains unconfirmed, and some investigators noted that the laundering pattern differed from previous attacks.

Binance's preliminary investigation suggested a compromised DevOps engineer's laptop gave attackers access to a service container, enabling unauthorized withdrawals. The exchange found no evidence of leaked wallet private keys. TRM found that attackers used an EIP-7702 delegation and 50 pre-signed authorisations to control an Ethereum hot wallet, while ordinary signed transfers were used across nine other blockchains, pointing to a compromise of Binance's hot-wallet signing infrastructure.

Tether, Circle, Ripple and World Liberty Financial, alongside Arbitrum's Security Council, helped freeze approximately $3 billion in assets. Tether froze over $1.57 billion in USDT and Circle more than $800 million in USDC. Arbitrum froze another 8,426 ETH and 74.6 million ARB. However, attackers converted around 325 million USDT into ether at a discount exceeding 10 per cent and borrowed ETH against USDT on Aave. They still hold over 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion. The bitcoin remains across 19 wallets, including 17 holding exactly 1,000 BTC each. Investigators expect further laundering attempts through bridges, swap services and over-the-counter brokers. Recovering frozen funds will require legal processes.

Binance has promised to cover 100 per cent of customer losses. It said it had replenished 90 per cent of the $6.3 billion stolen and set aside more than $6.34 billion in company funds. The remaining 10 per cent could take longer to source. Bitcoin, ether, Tether and seven other widely traded cryptocurrencies are covered. "Binance will absorb the financial impact of these stolen funds, not our users," the exchange said.

Binance suspended deposits and withdrawals, revoked the affected address authorisation and contacted law enforcement and blockchain intelligence firms. Deposits have resumed, while withdrawals are expected to restart on Sunday, November 1. The exchange also promised a technical post-mortem and updated proof of reserves. Its Secure Asset Fund for Users (SAFU), established in 2018, holds approximately $1 billion entirely in bitcoin.

The hack also triggered a public exchange between former Binance CEO Changpeng Zhao and Elon Musk. After Musk appeared to mock the incident with laughing and grimacing emojis on X, Zhao asked him not to "troll" Binance and instead "show a little support". Zhao reminded Musk that Binance's $500 million investment in his Twitter takeover had given it a SpaceX stake now worth more than $1 billion. The two had clashed in November 2021 when Musk criticised Binance for suspending Dogecoin withdrawals, prompting Zhao to highlight Tesla's recall of nearly 12,000 US vehicles over software and hardware issues.

The breach rattled markets, with Bitcoin falling 4.8 per cent below $77,000, ether declining 5.7 per cent and BNB dropping 8 per cent. Leveraged liquidations reached approximately $1.5 billion, mostly affecting long positions. Standard Chartered's Geoffrey Kendrick warned that market pressure could continue and suggested the incident might accelerate interest in decentralised exchanges.