Twenty minutes. That is roughly how long it took, starting at 4:05 p.m. ET on Thursday, for most of about $6.36 billion to leave Binance wallets across 10 blockchains, per TRM Labs. The Binance hack is now the largest crypto theft on record, around four times the $1.5 billion Bybit heist of February 2025.
The exchange confirmed the loss by Friday, and by Friday afternoon the analytics industry had mostly settled on a culprit. What follows covers what is established, what is not, and where the stolen money sits.
Twenty minutes, ten chains
The first public alarm came from a researcher posting as Spreek, who noticed assets leaving a Binance-linked Ethereum wallet for a freshly created address, via a contract call that had reportedly been funded through Tornado Cash. The same researcher later saw connected wallets start offloading Tether's USDT on decentralized exchanges. Arkham Intelligence then tagged a cluster of addresses as "binance-hacker-1029" holding about $5.84 billion. That was a balance snapshot and not an official loss figure, a distinction that mattered for a few hours.
Changpeng Zhao, who co-founded Binance, publicly described the incident as a hack and voiced confidence that customers would be compensated in full. The exchange itself, as Cointelegraph reported, confirmed roughly $6.3 billion in affected assets and promised to cover everything from its Secure Asset Fund for Users plus company money.
The tallies differ by a few percent depending on who is counting: TRM says $6.36 billion, Chainalysis about $6.4 billion, Binance $6.3 billion. Nobody disputes the order of magnitude.
One oddity of the news cycle. Polymarket had halted trading hours earlier after a compromise at a third-party provider, then restored service and promised reimbursements. Nothing published so far connects the two incidents, and until someone shows otherwise it remains a coincidence.
Why the finger points at Pyongyang
Three analytics shops have now landed on North Korea, and two of them name a specific unit: TraderTraitor, the group the FBI tied to the Bybit theft. As Cointelegraph laid out, TRM claims high confidence, resting on onchain and offchain intelligence. Chainalysis CEO Jonathan Levin was more guarded, saying the group was likely responsible because of links to a previous hack.
The linking evidence is the interesting part. ZachXBT observed loot from Binance and from last month's Bitget exploit (about $352 million, which Bitget's CEO already suspected was North Korean) landing in the same address after passing through THORChain. Chainalysis described watching the two streams commingle in real time. The natural reading is one wallet, one operator. A court would want more, but investigators treat this sort of overlap as a fingerprint, and the alternative reading, a shared laundering service used by unrelated thieves, would need its own explanation.
There is more circumstantial weight. TRM and Chainalysis both found that the attacker's operational wallet was funded through Tornado Cash. TRM adds that preparation began well before the theft, a pattern it saw in Bybit and in April's KelpDAO exploit. Singapore's Pangolin Intelligence reached the same conclusion on its own, per CNN. North Korea has denied hacking accusations in the past, and nothing suggests this time will differ.
A flag on speculation: attribution in crypto is probabilistic work, and the firms doing it have commercial reasons to be quick. Even so, four semi-independent groups converging on one answer is a better signal than any single press release.
Inside the machinery of the theft
Decrypt's summary of the TRM analysis describes the Ethereum leg as dependent on EIP-7702, a Pectra-upgrade feature that lets a plain externally owned wallet run smart contract code on a temporary basis. Through a delegation, the attacker effectively repurposed one Binance hot wallet so that it drained funds on the attacker's instructions. Fifty authorizations had been signed ahead of time, which points to a rehearsed operation with a script rather than improvisation.
On the other nine chains no contract trickery was needed. Binance wallets simply sent funds out through ordinary signed transfers, and TRM reads that as pointing to compromised signing infrastructure for the hot wallets. If you can make the exchange's own signers produce valid transactions, you never have to break any chain's cryptography.
Binance has said the investigation started with a compromised engineer's laptop, and that further breach points have since turned up. The company has not said how many, or whether they are all human-factor failures, and the gap matters. One laptop is a story about a single phished employee; multiple entry points would be a story about architecture.
The pattern will sound familiar. Bybit began with one compromised machine too: North Korean operators got into a Safe developer's computer and planted malicious code in the wallet provider's infrastructure. The FBI's account of the May 2024 DMM Bitcoin theft, more than $300 million, has the same shape. Per that account, a fake recruiter approached an employee at the wallet provider Ginco with a coding test laced with malware, and the access that followed was likely used to manipulate a genuine transaction request.
Across three of the biggest thefts ever, then, the common element is a person with a laptop rather than a protocol bug. Binance's own security chief, Jimmy Su, told Decrypt in August 2025 that North Korean operatives try to get hired at the exchange every day and are the biggest single threat to crypto firms. On Wednesday, the day before the theft, the US Treasury announced sanctions on ten people and one entity tied to North Korean IT-worker schemes that funneled millions in crypto. Washington evidently sees the hiring pipeline as a front. Whether Binance's screening held up against that pressure is a question the exchange has not answered publicly.
The design lesson is blunt. Hot wallets that can move billions in minutes, across ten chains, with signing that a single compromised workstation can influence, amount to a concentration risk that no insurance fund quite makes comfortable. Binance is far from alone in running that model.
Racing the freezes
Here the attacker showed real operational skill. Chainalysis says it is seeing laundering patterns it has never encountered, with thousands of transactions in a short window that suggest automation cycling funds repeatedly between addresses. TRM adds that the thief offloaded USDT to market makers and took out ETH loans on Aave with USDT as collateral, swapping freezable stablecoins for assets no issuer controls before the freezes landed.
It partly worked. TRM figures the attacker now holds over 420,000 ETH and 18,270 BTC. At prices quoted Friday (ETH around $2,226, BTC around $76,800), my back-of-envelope math lands near $2.3 to $2.4 billion, which matches TRM's estimate of roughly $2.4 billion beyond any issuer's reach.
The freezers moved fast too. Circle's Jeremy Allaire said more than $800 million in USDC was locked in coordination with law enforcement. Tether's Paolo Ardoino announced over $1.567 billion in USDT frozen, and wrote that "Protecting the industry and our partners is our main priority." Zhao gave slightly different early numbers, $971 million for Tether and $823 million for Circle. TRM's later tally has Tether, Circle, Ripple and World Liberty Financial together holding about $2.67 billion. Arbitrum's Security Council also stepped in, immobilizing 8,426 ETH alongside 74.6 million ARB tokens on that network. Binance puts the grand total of frozen assets near $3 billion.
A rough subtraction: $3 billion frozen plus $2.4 billion in native ETH and BTC leaves something near $1 billion unaccounted for. That could have been laundered through mixers and swaps, or it could be an artifact of overlapping measurements, and I would treat the figure as loose arithmetic and not a finding. Nobody has published a clean ledger of where every dollar stands.
Who pays, and what comes next
For customers, the exchange's position looks strong on paper. Binance says the reserves it has earmarked for reimbursement exceed $6.34 billion, enough to cover the whole loss with a sliver to spare, and that about $5 billion of that pile already sits in the same assets that were taken. The remainder is being bought on markets and over the counter, which may be slow where liquidity is thin. Those figures exclude frozen assets. The company says it has started returning affected assets to users and is working with the FBI, issuers and analytics firms. Its public line: "We will weather this storm."
Three things to watch. First, whether the roughly $2.4 billion in ETH and BTC starts moving, and into which off-ramps. Bybit's haul was laundered over weeks through a mix of bridges and over-the-counter brokers, and the same playbook would test THORChain and Aave governance again. Second, whether Binance publishes a post-mortem that says plainly how many breach points there were and how signing authority was structured. Third, whether Washington responds with another round of sanctions or seizures aimed at the facilitators, since the Treasury's Wednesday action suggests the machinery is already running.
One more open item. If a single stolen-funds address can sit at the center of Bitget, Binance and Bybit, investigators have a rare chain of custody to follow. Whether anyone can turn that trail into recovered coins, as opposed to merely better attribution, is the part nobody can answer yet.