--- As for the methods used to withdraw funds in the Binance hack, according to data from on-chain analytics firms such as Chainalysis, the attackers employed highly automated money-laundering methods never seen before. The core strategy was to convert freezeable assets (such as stablecoins) into non-freezeable assets (such as ETH) as quickly as possible, and to use automated scripts to conduct thousands of transactions within a short period in order to obscure the trail. ### 🤖 Key Characteristics: Automation and "Back-and-Forth" Transfers Chainalysis explicitly stated that the money-laundering patterns in the Binance hack are "unprecedented." Unlike the traditional approach of a few large transactions, the attackers used automated scripts to conduct thousands of transactions within a short period, and the funds were not simply moved in one direction but circulated repeatedly among multiple addresses, sometimes even returning to previously used addresses, which significantly increases the difficulty of tracking and analysis. Analysts also identified a characteristic programmatic pattern: many addresses first receive exactly 1 TRX, then receive additional funds and forward them onward. ### 💱 The Key Step: Converting Stablecoins to ETH to Avoid Freezing This is the most critical step in the laundering process. Because USDT, USDC, and other stablecoins have centralized issuers that can freeze assets at specific addresses at the smart-contract level, the attackers sought to get rid of these "freezeable" assets as quickly as possible. According to Chainalysis and other sources, the attackers transferred about $500 million in stablecoins to a dedicated exchange address. Over approximately 20 minutes, this address exchanged $325 million in stablecoins for $285 million in ETH, and the remaining $175 million was moved to intermediate addresses within 10 minutes after the exchange was completed. Because native ETH has no centralized issuer, no organization can directly freeze these funds after conversion, giving the attackers more room to maneuver. ### 💎 Summary Simply put, the core logic of the fund withdrawal in the Binance hack was as follows: first, quickly convert freezeable stablecoins into non-freezeable ETH; then use highly automated scripts to conduct mass transactions within a short period, splitting and mixing the funds to make tracking as difficult as possible. Although this method does not allow the attackers to completely avoid freezing (as of October 30, about $2.8 billion had been frozen), it significantly reduces the likelihood of recovering the remaining funds. 🫥

## Binance Hack of ~$6.3 Billion: The Largest Theft in Crypto History On October 29, 2026, Binance, the world's largest cryptocurrency exchange, suffered an attack that drained approximately $6.3 billion in digital assets. It became the largest crypto theft in history — the previous record belonged to Bybit (~$1.5 billion, February 2025). The bulk of the funds was withdrawn in just ~20 minutes. ### 🕵️ Attack Mechanism: An Engineer's Laptop and Signing Infrastructure Compromise Binance's investigation found that the initial point of entry was a compromised DevOps engineer's laptop. According to the exchange, the attacker used it to gain access to a service container and was able to initiate unauthorized withdrawal transactions. However, according to Binance co-CEO Richard Teng, the attack was not a "one-click" job: the attacker "used a self-destruct mechanism that destroyed tools and covered tracks as it went," which complicated the investigation. Blockaid clarified a technical detail: the attack likely represented a compromise of signing infrastructure rather than the theft of private keys. The attackers used the EIP-7702 standard to delegate account control to a malicious smart contract, which allowed funds to be withdrawn without direct access to keys. Binance stated that it found no evidence of private key leakage from wallets. The investigation is still ongoing, and a full technical report will be published later. ### 🌐 Scope and Affected Networks According to TRM Labs, funds were withdrawn from wallets on 10 blockchains, including Bitcoin, Ethereum, XRP, Tron, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. The largest damage was on Ethereum — about $3.79 billion. Preparation for the attack, according to TRM Labs estimates, began at least 36 hours before the actual withdrawal. ### 🧊 Freezing and Loss Coverage Binance temporarily suspended withdrawals (deposits continued to work). Together with partners, the exchange managed to freeze about $3 billion of the stolen assets. In particular: - Tether froze more than $1.5 billion in stablecoins. - Circle froze about $800 million. - TRM Labs estimates the total amount of frozen funds at approximately $2.7 billion. Richard Teng confirmed that Binance will cover all losses from its own funds and the SAFU (Secure Asset Fund for Users) insurance fund. User funds were not affected. ### 🕵️ Attribution: TraderTraitor (DPRK) Several analytics firms with "high confidence" link the attack to the North Korean hacking group TraderTraitor, which is part of the notorious Lazarus Group. - TRM Labs stated that the conclusion is based on "reliable on-chain and off-chain sources." - Chainalysis also attributed the attack to TraderTraitor, estimating the stolen amount at $6.4 billion. - No official confirmation from U.S. authorities had been issued at the time of publication, although the FBI previously accused TraderTraitor of the $1.5 billion Bybit hack in 2025. ### 🔗 Connection to the Bitget Hack On October 29–30, on-chain detective ZachXBT reported that the ~$6.3 billion stolen from Binance and the ~$388 million stolen from Bitget were transferred through THORChain and mixed at a single address (0x151…eb7). This indicates that the same attacker likely stands behind both attacks. The Bitget hack had previously been linked to TraderTraitor as well. ### 📉 Market Reaction Despite the scale of the theft, the market reaction was relatively muted. Bitcoin momentarily fell below $77,000 (a low since September), but the overall decline was about 6.7% — less than during the Mt. Gox hack in 2013 (35%) or Bybit in 2025 (7.5%). Analysts explain this by the fact that the blow hit the exchange itself rather than user funds directly, and Binance committed to covering all losses. 😎

There is no official confirmation of specific actors, but Bitget CEO Gracie Chen called North Korea's involvement "highly likely." Chainalysis, in an October 1, 2026 report, also attributed the attack to North Korea-linked actors, noting that it raised the total volume of funds stolen by the DPRK in 2026 to more than $1 billion. Additional evidence came from on-chain detective ZachXBT: on October 29–30, he reported that the stolen Bitget funds were mixed at a single address (starting with 0x151) with funds stolen from Binance (~$6.3 billion), indicating a possible common organization behind both attacks. 📌 **Bottom Line** The Bitget hack is an example of a carefully planned attack that exploited supply chain vulnerabilities rather than weaknesses in cryptography. Although users did not lose their funds and the losses were covered by the insurance fund, the vast majority of the stolen assets have already been laundered through cross-chain protocols and mixed with proceeds from other major hacks, making their recovery extremely difficult. 😎