On October 31, the FBI attributed the October 29 theft from Binance hot wallets to North Korea’s TraderTraitor group. Chainalysis’s analysis describes a specific on-chain link behind its own assessment: funds from the Binance theft commingled with funds from an earlier Bitget theft that Chainalysis attributes to North Korean actors. Chainalysis estimated the Binance theft at about $6.4 billion.
The on-chain link Chainalysis cites
Chainalysis says the Binance-linked funds and funds from the earlier Bitget theft came together on-chain. The firm called this direct transaction link its strongest evidence for the TraderTraitor assessment, adding to an assessment it had initially based on laundering patterns. Its analysis describes an investigative basis for the attribution; the FBI separately made its own attribution.
For readers following the customer-loss response, NeoTeo covered Binance’s reported reimbursement separately.
How the transfers unfolded
Chainalysis says the theft began around 4:20 p.m. ET on October 29. On Ethereum, an operational wallet funded through Tornado Cash submitted signed authorizations that allowed a Binance hot wallet to run code deployed by the attacker and sweep assets. A signed authorization is approval for a wallet to carry out a transaction or action. Other affected wallets appeared to send ordinary signed transfers, according to the firm’s analysis.
Chainalysis reports that $325 million in stablecoins was exchanged for $285 million in ETH over nearly 20 minutes. Stablecoins are cryptocurrencies designed to track the value of another asset, often the U.S. dollar; ETH is the cryptocurrency used on the Ethereum network. Ten minutes after that exchange, another $175 million in stablecoins went to stopover wallets. Chainalysis says stablecoin freezes began at 5:14 p.m. ET on October 29.
That sequence puts the conversions and freezes in the same short window. The converted amount and the later stablecoin transfer are separate reported flows, and neither figure describes the full estimated theft.
