North Korea’s $6.3B Binance Heist Is Spinning Up a Wallet Every 25 Seconds

The FBI said on October 31, 2026, that North Korea was responsible for stealing more than $6 billion in cryptocurrency from Binance on October 29, 2026, attributing the attack to the state-linked TraderTraitor group and publishing wallet addresses for industry participants to block. The FBI said the theft began at about 4:05 p.m. ET Thursday and compromised Binance’s hot wallets, while Binance said early findings pointed to a hacked employee laptop before investigators identified additional breach points. The exchange, which has pledged to cover the losses, resumed withdrawals Sunday and reported about $3.64 billion in net outflows during the first nine and a half hours, with related figures cited in other reports placing the overall theft at $6.3 billion to $6.4 billion.

Blockchain analytics firm Elliptic said the attackers had shifted roughly $3.46 billion, or 54% of the haul, into stablecoins before spreading it across about 12,000 wallets on 11 blockchains through more than 40,000 transactions. About $2.85 billion, or 44%, of that stablecoin total had been frozen or seized, compared with roughly 3% after North Korea’s $1.5 billion Bybit hack in February 2025. Tether froze the stolen USDT on Ethereum 37 minutes after it reached an attacker-controlled wallet, while Circle froze all $823 million in stolen USDC before it could be swapped, according to Elliptic.

Before the freezes took effect, the hackers swapped 434 million USDT for $ETH on decentralized exchanges including Uniswap, borrowed 19,762 $ETH on Aave against another 59.9 million USDT, and traded 234 million USDT for TRX. About $786 million in stablecoins escaped the freezes, while Lookonchain reported that the hackers moved 486,970 SOL tokens worth about $46.4 million and began swapping them for $BTC through Relay. Chainalysis said roughly $500 million in transfers had moved through Tron holding wallets during the laundering process, although SomaXBT said about $242 million actually left those wallets.

Tron activity peaked at about 1,300 transactions in a single hour as the attackers moved funds through a new wallet roughly every 25 seconds. Chainalysis observed repeated transfers among temporary wallets, including movement back to addresses used earlier in the sequence, and said the hackers may be using automation to obscure the trail. Although Elliptic described the laundering as clearly automated, it said the fixed timing, set amounts, blind retries and pauses resembling human working hours meant that “nothing we have seen shows an AI agent making decisions.”

The FBI said investigators had observed stolen assets being converted primarily into $ETH and expected further laundering through decentralized finance and instant swap services. The US Secret Service and IRS Criminal Investigation also urged THORChain node operators, exchanges and decentralized finance services to block transactions involving the published addresses or funds traced to them. Some stolen assets reached Gate, where the hackers deposited about $250,000 over a 12-hour period before Gate froze two linked accounts and said it would cooperate with law enforcement; its statement did not specify the amount frozen.

About $3.5 billion remained under attacker control according to SomaXBT, while Elliptic estimated that about $3.24 billion remained in addresses linked to the theft, mostly $ETH and the 18,270 stolen $BTC, which had not moved since the day of the attack. Another $16 million flowed to addresses holding proceeds from September’s Bitget exploit, and only a negligible amount appeared to have been cashed out. The FBI said the incident triggered a cross-border law-enforcement investigation, while Tether, Circle and other industry partners froze about $3 billion in stolen assets as Binance worked with US authorities to trace and recover the funds.