Binance Hack Linked to North Korea Causes $6.3 Billion Loss Amid Market Resilience

The crypto market has shown resilience following the $6.3 billion hack of Binance, with less disruption than experienced during the FTX collapse, according to Haseeb Qureshi, managing partner at Dragonfly. In a statement, Qureshi noted that crypto prices only fell a few percent after the incident, as investors continued to buy the dip despite a global economic downturn.

Unlike the FTX crisis, which resulted in an estimated $8 billion in losses and widespread bankruptcies across the crypto sector, the market's reaction to the Binance hack was muted. Binance has committed more than $6.3 billion from its corporate funds to reimburse affected users and has begun restoring their assets. The exchange holds approximately $5 billion in the token assets involved and is sourcing the remaining amount through market purchases.

Blockchain analysis firms Chainalysis and TRM Labs have linked the hack to a unit associated with North Korea, known as TraderTraitor. The attack reportedly began on October 29, with funds leaving Binance's hot wallets shortly after the breach. The attacker exploited a compromised engineer's laptop to gain unauthorized access, allowing them to withdraw assets.

In the wake of the hack, Bitcoin's decline was relatively limited, dropping approximately 5% compared to a 26% drop during the FTX collapse. The market had already been under pressure from macroeconomic factors, including Federal Reserve rate hikes and previous failures in the crypto industry.

Despite the negative impact of the hack, coordinated efforts across the industry helped mitigate the fallout. Stablecoin issuers such as Tether and Circle moved quickly to freeze affected assets, totaling over $2.3 billion. Binance continues to work with law enforcement agencies, including the FBI and the U.S. Secret Service, to address the situation.

New Insights on the Binance Hack

• The attacker exploited Ethereum’s EIP-7702 authorization feature to drain approximately $2.5 billion from Binance’s Ethereum hot wallet.
• The attack transformed Binance's wallet into an automated fund-draining mechanism by allowing a smart contract to control transaction execution.
• Binance's broader security breach is estimated to have affected approximately $6.3 billion across multiple blockchain networks.
• The attack may have originated from a compromised DevOps engineer's laptop, which potentially provided access to internal infrastructure.
• Approximately $3 billion of the stolen assets have been frozen in coordination with stablecoin issuers and blockchain partners.
• The incident raises significant questions about the balance between wallet functionality and secure authorization processes in the cryptocurrency industry.

New Facts About the Binance Hack

• The Binance hack is one of the largest heists in history, exploiting wallet delegation on Ethereum.
• The attacker deployed a sweeper contract and sent 50 EIP-7702 authorizations targeting the Binance 14 address.
• Each authorization was signed with the Binance 14 key and required matching nonce values for approval.
• Other wallets outside of Binance 14 did not rely on delegation, using normal transactions instead.
• Binance has frozen or blacklisted approximately $2.4 billion worth of funds removed from Binance wallets on Ethereum.

New Developments on Binance Hack and THORChain

• THORChain’s RUNE token surged over 13% to $0.67 following the confirmation of Binance's $6.3 billion security breach.
• Funds linked to both the Binance hack and the September $388 million Bitget hack have been traced through THORChain.
• The Bitget hack has been attributed to the hacking group TraderTraitor, which is associated with North Korea.
• Blockchain intelligence firms have connected the Binance attack to North Korean hackers as well.
• Binance's preliminary investigation suggests that a compromised DevOps engineer's laptop may have facilitated unauthorized withdrawals.
• THORChain has faced scrutiny for its role in previous hacks, including the $1.4 billion Bybit attack in February 2025.
• Despite the controversies, THORChain's RUNE rally indicates a positive market response, though it raises concerns about security and governance in decentralized finance.

Latest Developments on the Binance Hack

• The US Secret Service confirmed its partnership with Circle on October 30, 2026, to recover approximately $6.3 billion stolen from Binance.
• The breach occurred on October 29, 2026, and reportedly took place within 20 minutes, affecting assets across ten different blockchains.
• Binance has temporarily suspended withdrawals and pledged to use its Secure Asset Fund for Users (SAFU) to cover user losses, with over $6.34 billion set aside for this purpose.
• Circle has frozen over $800 million in USDC related to the incident, while Tether has frozen around $1.57 billion in USDT, bringing the total frozen assets to approximately $3 billion.
• Blockchain analysis firms have linked the theft to North Korean actors, specifically a group known as TraderTraitor, although this attribution remains unconfirmed.
• The FBI is involved in the recovery efforts alongside the Secret Service and Binance, indicating a coordinated response to the incident.
• Binance's commitment to repay users in the same tokens they lost is seen as a protective measure against potential tax implications from cash settlements.