preferred on
Points of Focus
- Issuers froze about $2.7 billion of the $6.36 billion stolen from Binance.
- The attacker holds $2.4 billion in ETH and BTC that no issuer can freeze.
- Bybit’s thieves bridged to Bitcoin in 10 days, and North Korean cycles run about 45.
As of 00:30 UTC on Oct. 30, the Binance hacker held about $2.4 billion in Ether (ETH) and Bitcoin (BTC) that no stablecoin issuer can freeze, which makes cashing out the harder half of the heist.
User funds are safe!
It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m).
I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered. https://t.co/oufpyNChxI
— CZ 🔶 BNB (@cz_binance) October 29, 2026
TRM Labs estimated that the attacker took about $6.36 billion from Binance on Oct. 29 and that issuers and Arbitrum’s Security Council froze about $2.7 billion by that time, while Binance said at 07:53 UTC on Oct. 30 that about $3 billion is frozen onchain.
Earlier North Korean thefts show that this stage takes weeks, not hours.
Binance hack freezes cover 42% of the $6.36 billion stolen
Tether froze about 1.77 billion USDt (USDT) and Circle about 825 million USDC (USDC), with Ripple and World Liberty Financial adding 68.3 million in frozen stablecoins. Stablecoins were about $3.4 billion of the haul, equal to 8% of the $42.1 billion in Binance stablecoin reserves on Aug. 12, and roughly 78% of them are frozen.
1/ Everything you need to know about the Binance hack.
(written entirely by Claude using the Blockworks MCP)
A thread 🧵 pic.twitter.com/CUPz6ZFTIl
— Yano 🟪 (@JasonYanowitz) October 30, 2026
The limits on freezing crypto explain the split because Tether and Circle can blacklist addresses, while Bitcoin and Ethereum have no administrator able to block one.
The attacker raced the freezes by selling 325 million USDT through UniswapX for about 122,300 ETH at a discount TRM puts above 10%, a cost of about $41 million. That haircut shows the thief valued escape over price.
Binance hacker holds $2.4 billion beyond any issuer’s reach
TRM counts more than 420,000 ETH and 18,270 BTC in attacker wallets, with the Bitcoin moving through a peel chain that splits it into 1,000 BTC and 100 BTC pieces.
The 18,270 BTC equals 127% of Binance’s average daily BTCUSDT volume for Oct. 1 to 29 and about four times Strategy’s August Bitcoin repurchase of 4,603 BTC.
BTC fell 5.4% from its 20:00 UTC open on Oct. 29 to a $76,500 low on Oct. 30 after the outflows began. A sale on exchange order books would be equally visible, so over-the-counter (OTC) desks and swap services are likelier exits.
North Korea laundering has taken 10-45 days after past heists
TRM attributes the theft to TraderTraitor, North Korea’s elite hacking unit, with high confidence, while Binance names no actor.
After Bybit, TRM reported that all stolen ETH had moved to new addresses by March 3, 2025, 10 days after the Feb. 21 theft, with most bridged to Bitcoin, much of which sat largely still.
Chainalysis found a 45-day laundering cycle after major thefts and slightly over 60% of North Korean volume in transfers below $500,000, so $2.4 billion implies thousands of transfers.
Elliptic traced Bybit funds to Tron, where they became USDT and were cashed out through suspected Chinese OTC services.
The Financial Crimes Enforcement Network severed Huione Group from the US financial system on Oct. 14, 2025, calling it a critical node for laundering North Korean cyber heists. Lazarus-linked flows through Hyperliquid topped $30 million by Aug. 31, converting Bitcoin into ETH and Solana (SOL), so the route was live before this theft.
Exchanges now carry legal risk. The Eleventh Circuit’s Aug. 19 ruling lets theft victims sue Binance over claims that its controls made it an exit point for stolen assets, which remain unproven.
TRM sees the same fingerprints as the April $292-million Kelp DAO exploit, which LayerZero preliminarily attributed to Lazarus Group. The $2.4 billion is spendable only as fast as exits absorb it, and every exit that screens addresses shrinks that rate.
Chainalysis put the lower-bound all-time North Korean theft total at $6.75 billion on Dec. 18, 2025, so this one theft equals 94% of it.
Share
Most read articles
