Calls for Crypto Rules Grow as Binance Hack Is Tied to North Korea
Investigators attribute the record Binance theft to North Korea's TraderTraitor while CFTC Chair Selig, Sen. Lummis and The Digital Chamber press for legislation. TRM and Elliptic detail how the hot wallets were drained and where more than $6 billion went.
Update: October 30, 22:47 UTC
Binance co-CEO Richard Teng said investigators have found additional breach points, along with evidence that the attacker bypassed approval controls and used tactics to destroy evidence, according to Bitcoin.com News. Teng outlined a rebuild of the withdrawal service and a companywide security review.
Binance has revoked the authorizations of affected addresses and is working with law enforcement and blockchain firms to trace and recover assets, CryptoPotato reported. Bankless reported the exchange says it will cover the full $6.3 billion loss.
Markets fell on the news. Bitcoinist reported BNB dropped more than 8%, Bitcoin neared $77,000, Ethereum slid below $2,300 and over $1.5 billion in leveraged positions were liquidated.
Original report: October 30, 21:27 UTC
Washington's answer to the largest crypto theft on record came on Friday as a set of demands for legislation. CFTC Chair Michael Selig told CNBC that the Binance hack vindicated the agency's Oct. 5 proposed framework. Sen. Cynthia Lummis argued that the stalled Clarity Act would have let firms freeze suspicious transactions, and The Digital Chamber asked Congress for a bill giving the CFTC authority over crypto exchanges. Over the same stretch, Chainalysis, Elliptic and TRM attributed the theft to North Korean hacking groups.
Binance was hit on Thursday, Oct. 29, and investigators estimate more than $6 billion was stolen. Our earlier coverage reported the breach and the initial US response without naming a culprit, and our follow-up tracked the exchange's withdrawal restart plan. TRM now names the group as TraderTraitor, a North Korean hacking unit, and links it to the $1.5 billion Bybit hack.
Washington responds
President Trump said at a Friday press conference that he was looking into the hack. Selig went further and framed the theft as proof that the CFTC's rulemaking was overdue.
"This proves our exact point in proposing regulations for crypto markets earlier this month,"
Michael Selig
Selig called Binance an unregulated offshore exchange. The Digital Chamber's Cody Carbone sent Congress a letter asking for a bill that gives the CFTC authority over crypto exchanges and requires segregation of customer and company funds in bankruptcy.
Lummis said in a post on X that the Clarity Act would have let firms freeze suspicious transactions. Amanda Fischer of Better Markets disagreed, saying the bill would have required a court order for stablecoin freezes. Patrick Wilson countered that a section expressly protected voluntary temporary holds with no court order needed.
How the attacker got in
Binance has traced the entry point to a compromised DevOps engineer's laptop and unauthorized access to a service container used to submit withdrawal transactions. It has not identified a private-key leak, and co-CEO Richard Teng has described the attack as more complex than a compromise of a single employee's permissions. The analytics firms supply the rest of the sequence.
TRM says the attacker began staging at least 36 hours before the theft, funding an operational wallet with small Tornado Cash withdrawals and deploying and testing malicious code on three wallets.
On Ethereum, the attacker used EIP-7702 to turn a Binance hot wallet into a sweeper, preparing 50 pre-signed authorizations in advance. Coordinated transfers across nine other blockchains, TRM said, suggest the broader hot-wallet signing infrastructure was compromised, which would mean the problem was less a single unlocked door than a master key to the building.
"One of the striking things about this breach is how little code was actually needed on-chain. The sweeper contract was only around 130 lines,"
Simone Imbrescia, Immunefi
Elliptic says the attacker kept access after the first exploit, using one compromised wallet's owner rights to withdraw from another Binance wallet and repeatedly sweep new deposits. A second Ethereum hot wallet sent $174 million directly to the attacker.
Where the money went
Speed mattered more than price. The attacker converted $325 million in stablecoins into $285 million in ETH over nearly 20 minutes to avoid freezes, accepting losses of up to 26% against market prices when swapping USDT for ETH.
Elliptic said the attacker also deposited $59.9 million in USDT into Aave as collateral and borrowed 19,762 ETH, a loan that was near liquidation at the firm's latest update. Aave said Friday it had unfrozen all V3 and V4 markets, that its contracts were unaffected and that positions remained fully collateralized.
Chainalysis found onchain links between the stolen funds and proceeds of last month's Bitget exploit, also attributed to North Korea. Elliptic cautioned that the overlap involved only a small portion of the funds and did not conclusively prove the same attackers were responsible.
Covering the hole
Binance has about $5 billion in affected assets on hand, with another $1.3 billion being acquired through market and OTC channels to cover losses. Teng said the exchange targets Monday for its first proof-of-reserves report and hopes users can withdraw within 40 hours.
What it means
The attribution matters because it ties a centralized exchange failure to the same state-linked group investigators blame for the $1.5 billion Bybit theft, and this one is roughly four times larger. TD Cowen analysts framed it as centralized intermediary risk rather than a failure of Bitcoin or its network, a distinction that points the policy debate at custody and hot-wallet controls rather than at the underlying chains.
That debate now runs through Congress. The Clarity Act passed the House last year but has stalled in the Senate, and the freeze-authority dispute between Lummis, Fischer and Wilson shows how far apart readers of the same bill remain on what it would actually have done.
