Binance’s $6.4B Heist Is Playing Whack-a-Mole Across 11 Blockchains

North Korea’s TraderTraitor hackers stole roughly $6.4 billion from Binance in the largest theft in cryptocurrency history, then spread the proceeds across about 12,000 wallets on 11 blockchains through more than 40,000 transactions in under four days. The FBI attributed the Thursday attack to the state-linked group and published hundreds of wallet addresses as the US Secret Service and IRS Criminal Investigation urged THORChain node operators, exchanges and decentralized finance (DeFi) services to block transactions involving the addresses or funds traced back to them. Binance said the attack compromised its hot wallets, with early findings pointing to a hacked employee laptop before investigators identified additional breach points. The exchange reopened withdrawals Sunday, pledged to cover the losses and began working with US authorities to trace and recover the assets.

Elliptic reported that the hackers were creating roughly one new wallet every 25 seconds, with activity on Tron peaking at about 1,300 transactions in a single hour. Although the laundering was clearly automated, fixed timing, set amounts, blind retries and pauses resembling human working hours led Elliptic to conclude that “nothing we have seen shows an AI agent making decisions.” Chainalysis separately put the value of the Tron transfers at about $500 million, including repeated movements between wallets, while SomaXBT said about $242 million actually left the Tron holding wallets. Lookonchain reported that the hackers moved 486,970 Solana (SOL) tokens, worth about $46.4 million, and began swapping them for $BTC through Relay.

Stablecoin issuers froze or seized about $2.85 billion, or 44% of the haul, compared with roughly 3% after North Korea’s $1.5 billion hack of Bybit in February 2025. Stablecoins represented $3.46 billion, or 54%, of the theft. Tether froze the stolen USDT on Ethereum 37 minutes after it reached the attacker’s wallet, while Circle froze all $823 million in stolen USDC before it could be swapped. Before the freezes landed, the hackers swapped 434 million USDT for $ETH on decentralized exchanges such as Uniswap, borrowed 19,762 ETH on lending protocol Aave against another 59.9 million USDT, and traded 234 million USDT for Tron’s TRX token. In all, about $786 million in stablecoins escaped.

Industry partners, including Tether and Circle, froze about $3 billion in stolen assets, while SomaXBT estimated the attackers still controlled about $3.5 billion. Elliptic said about $3.24 billion remained in addresses linked to the theft, primarily $ETH and 18,270 stolen $BTC that had not moved since the day of the attack. Chainalysis also described the stolen haul as $6.3 billion in its analysis. About $16 million also flowed to addresses holding proceeds from September’s Bitget exploit, while Lookonchain reported that about $250,000 reached centralized exchange Gate over a 12-hour period. Gate subsequently froze two linked accounts and said it would cooperate with law enforcement.

Binance recorded about $3.64 billion in net outflows in the first nine and a half hours after withdrawals resumed. The FBI said investigators had observed the hackers converting stolen assets primarily into $ETH and expected further laundering through DeFi and instant swap services. Only a negligible amount appeared to have been cashed out, and law-enforcement agencies continued their effort to block transactions connected to the published wallet addresses.