At about 4.20am Singapore time on October 30, while most of Southeast Asia’s crypto traders were asleep, money began leaving Binance. By the time the region’s markets opened, the world’s largest crypto exchange had suffered the biggest theft in crypto history.
Blockchain analytics firm Chainalysis has now published its reconstruction of the attack. It puts the loss at about US$6.4 billion across multiple blockchains, slightly above Binance’s own estimate of US$6.3 billion. It attributes the theft to TraderTraitor, a North Korean state-backed hacking group that has spent years targeting exchanges, DeFi protocols and investors to fund the regime.
Also Read: North Korea’s hiring scam just cost Binance US$6.3B. SEA’s engineers are on the shortlist
The attribution will get the headlines. The more revealing part of the report is how quickly everything happened. This hack was a race between a thief and the small number of companies that can freeze stablecoins, and neither side fully won.
How the attacker got in
According to Chainalysis, the attacker’s operating wallet on Ethereum was funded through Tornado Cash, a mixing service that hides where money came from. That wallet submitted valid signed authorisations that allowed a Binance hot wallet to run code the attacker had deployed. A hot wallet is an internet-connected wallet that exchanges use to process everyday withdrawals. The attacker then used that code to sweep the wallet’s assets into addresses it controlled. Other affected Binance wallets appear to have sent funds through ordinary signed transfers.
The word “valid” matters. No cryptography was broken. Binance’s systems signed exactly what they were told to sign. The exchange has traced the breach to a compromised laptop belonging to a single DevOps engineer, a point e27 examined in detail last week. Whatever the entry point, the outcome is the same: once an attacker can make an exchange authorise transactions, key security stops mattering.
A 54-minute sprint against the freeze button
Once the funds were out, the attacker faced a split problem. Billions were held in Bitcoin and Ether, which no one can freeze. Billions more were held in stablecoins such as USDT and USDC, which their issuers can blacklist.
So the attacker moved fast. US$500 million in stablecoins went to a wallet set up only to swap them. Over nearly 20 minutes, it converted US$325 million into US$285 million of ETH, giving up roughly US$40 million to get the money beyond the issuers’ reach. Ten minutes later, the remaining US$175 million went to stopover wallets, apparently in an attempt to stay ahead of a blacklist.
It was not fast enough. Freezes began at 5.14pm Eastern Time, 54 minutes after the first outflows. Chainalysis says about US$2.8 billion has been frozen so far. Binance has put its verified frozen total at US$3 billion, of which Tether and Circle together account for about US$2.4 billion.
The other side of the ledger is less reassuring. The attackers still control roughly US$2.4 billion in assets that cannot be frozen.
The awkward truth about who saved the day
The rescue relied on centralisation, the thing crypto was supposed to remove. Stablecoins could be frozen because a company sits behind each one and can switch individual tokens off. In this case, that is a feature. In most other cases, it is a dependency.
For Southeast Asia, this is not an abstract point. Stablecoins are fast becoming everyday financial infrastructure in the region. Nearly half of Asia-Pacific consumers say they are open to using them, and in markets such as Vietnam they have moved from workaround to regulated tool. Yet the power to freeze sits with a handful of issuers, mostly outside the region. That is part of the dollarisation problem the region has yet to address, and why it cannot simply license its way to stablecoin sovereignty.
Also Read: If Binance says user funds are safe, why did Bitcoin still fall to US$77,037.20?
Chainalysis also notes that much of the freezing happened independently, with organisations acting in parallel. That worked this time. But it is improvisation, not a system, and the next response may be slower.
Bitget’s fingerprints
The attribution rests on a specific piece of evidence. Chainalysis investigators watched in real time as funds stolen from Binance commingled on-chain with funds stolen in last month’s Bitget exploit, which had already been attributed to North Korea. That earlier heist cost Bitget US$387.5 million. Chainalysis announced its attribution at 12.30am Eastern Time on October 30, about eight hours after the first outflows. TRM Labs has separately said it has “high confidence” that TraderTraitor was behind the attack.
The pattern now covers the top tier of the industry. Bybit lost US$1.5 billion in February 2025 in a hack the FBI attributed to North Korea and TraderTraitor. Bitget followed last month, and now Binance. Size did not protect any of them. If anything, it made them more attractive targets, and it raises hard questions about the security standards exchanges have promised since 2022.
Laundering on autopilot
The laundering itself may be the most significant new detail. Chainalysis says it is seeing patterns it has not seen before. Thousands of transactions have run in a short period, with funds circulating between addresses and often returning to wallets used earlier in the chain, rather than moving in a straight line.
Many addresses follow the same sequence. They receive exactly 1 TRX, the native token of the Tron network, then receive larger amounts, then forward funds onward. On Tron, a new address has to receive a little TRX before it can be used. The identical first deposit points to a script creating and activating wallets in bulk, not a person moving money by hand.
Also Read: Crypto’s new threat is not a hack, but a knock at the door
That changes the economics of investigation. Laundering that runs on software can generate more noise than human analysts can work through, which pushes investigators towards automated tools of their own. It is worth noting that Chainalysis sells exactly those tools. Its report ends with a pitch for its KYT and Address Screening products. That does not make the analysis wrong, but readers should keep it in mind.
What comes next
Chainalysis expects the stolen funds to keep moving in the coming days. Binance has pledged to cover all losses from its SAFU reserve and company funds. The wider industry, meanwhile, is reconsidering whether so much money should sit with centralised exchanges at all. Standard Chartered has suggested the hack could accelerate a shift towards decentralised exchanges.
That debate will take years. The theft took less than an hour, and the laundering is now running automatically.
The post Binance’s US$6.4B hack was decided in 54 minutes, and the chase isn’t over appeared first on e27.