Chainalysis Ties Binance Hack to North Korea, Flags New Laundering
Chainalysis says the $6.3B stolen from Binance moved through thousands of automated transactions in never-seen-before patterns. Elliptic traced discounted USDT-to-ETH swaps built to escape Tether and Circle freezes, plus a $59.9M USDT deposit into Aave.
The $6.3 billion stolen from Binance did not sit still. Chainalysis says the attackers circulated the assets through thousands of transactions in laundering patterns it had not seen before, a volume that points to automated efforts to obscure the trail. Its investigation also links the theft to North Korean hackers.
The attack began at approximately 20:05 UTC on October 29 and emptied the exchange's hot wallets in about 20 minutes. Our earlier coverage walked through Binance's recovery plan; this piece follows what the tracing work now shows.
Attribution and the Bitget overlap
TRM Labs, Chainalysis and Elliptic all attribute the attack to North Korean actors, and TRM ties it to the group known as TraderTraitor. Chainalysis also found onchain links to proceeds of last month's Bitget exploit, which was likewise attributed to North Korea.
Elliptic urged caution on that point, saying the overlap involved only a small portion of funds and was not conclusive. The scale alone sets this case apart: before it, the largest crypto theft on record was about $1.5 billion from Bybit in February 2025, also tied to North Korean hackers.
Paying to escape the freeze
Elliptic's tracing shows how the attacker handled the stablecoins. Hundreds of millions of dollars in USDT were swapped for ETH through decentralized exchanges and market makers, at losses of up to 26% against market prices. The logic becomes clear once the mechanics are laid out: Tether and Circle can freeze USDT and USDC, while ETH has no issuer standing behind it to do the freezing. Paying a steep discount to reach an unfreezable asset is a rational trade when the alternative is losing the funds entirely.
The issuers still caught a large share. About $3 billion of the stolen assets, mostly USDT and USDC, was frozen by Tether and Circle.
On Ethereum, one Binance hot wallet sent 63 ERC-20 tokens and 167,464 ETH to the exploiter address in a single transaction. That address received another 28,006 ETH from a second hot wallet, plus funds from Arbitrum, Optimism and Avalanche.
Aave pulled into the trail
Elliptic says the attacker also deposited $59.9 million of stolen USDT into Aave as collateral and borrowed 19,762 ETH, a loan that was still open and near liquidation at Elliptic's latest update. Aave froze its markets across all networks, halting new supply and borrow positions, then said Friday it had unfrozen all V3 and V4 markets, with its smart contracts unaffected and user positions fully collateralized.
The token absorbed the shock. AAVE fell 5.67% in 24 hours, against declines of 3.46% for BTC and 3.93% for ETH, as more than $1.50 billion in crypto positions were liquidated, mostly longs. Already down 32.9% from $188 to $125.8, AAVE broke its $140 support and was testing a bullish order block near $115. The bullish case holds only as long as the weekly close stays above $113.4.
Cause and implications
Binance's initial investigation points to a compromised DevOps engineer's laptop and unauthorized access to a service container, and the exchange has not identified a private-key leak. TD Cowen analysts framed the lesson broadly:
"The evidence available so far points to a compromise of infrastructure at a centralized intermediary, rather than a failure of Bitcoin or its underlying network,"
Taken together, the case shows a pattern. The point of failure was operational security at a centralized custodian, while the laundering bends around the freeze powers of stablecoin issuers and, by Chainalysis's reading, leans on automation to bury the trail.
