Chainalysis Says Binance Loot Mixed With September Bitget Theft, and North Korea Now Tied to 89% of 2026 Hack Losses

Since Binance disclosed on Oct. 29 that attackers had drained about $6.3 billion from its hot wallets, tracing firms have filled in how the money moved and how much of it can still be reached.

The 20-minute race

Chainalysis says funds began leaving Binance hot wallets around 4:20 p.m. Eastern on Oct. 29. On Ethereum, the attacker used an operational wallet funded through Tornado Cash to submit valid signed authorizations. Those let a Binance hot wallet run attacker-deployed code, which then swept its assets to attacker-controlled addresses. Other affected wallets appeared to send funds through ordinary signed transfers.

Across chains, the unauthorized transfers totaled roughly $6.4 billion, Chainalysis says. TRM Labs puts the figure at $6.36 billion across ten blockchains.

The attacker knew stablecoins can be frozen. Chainalysis says it moved $500 million of stablecoins into a wallet built to swap them for assets that cannot be frozen. Over nearly 20 minutes, that wallet turned $325 million in stablecoins into $285 million in ETH.

Ten minutes later, the attacker sent the remaining $175 million in stablecoins to stopover wallets, apparently trying to outrun a blacklist. Freezes began by 5:14 p.m. Eastern, sooner than the attacker expected, according to Chainalysis.

What was frozen and what was not

Binance says about $3 billion is frozen. Chainalysis counts approximately $2.8 billion so far. The two figures are not identical, and neither firm has said whether they measure the same set of assets.

Stablecoin issuers Circle and Tether froze $2.4 billion within an hour of the attack, TRM Labs' Ari Redbord told CBS News. Ripple and World Liberty Financial also froze assets, according to TRM.

The harder number is the other $2.4 billion. TRM says that portion is bitcoin and ether, now "beyond any issuer's reach." Redbord said those assets "move on public blockchains, and they cannot be frozen." In his view, the best chance of recovery comes if the thieves try to convert the crypto into cash.

A Binance spokesperson said the exchange "has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners." Binance has set aside more than $6.34 billion in company funds to cover the losses and says it is covering every loss.

The Bitget link

Several laundering patterns first pointed Chainalysis toward TraderTraitor. The strongest evidence, it says, came when investigators watched Binance proceeds commingle in real time with funds stolen in last month's Bitget exploit. That September theft totaled $387 million and has also been linked to TraderTraitor.

The attribution rests on analysis by private firms. North Korea denies involvement in hacking, and no government has announced charges in the Binance case. The U.S. Secret Service said it is "working around the clock" to identify, freeze, trace and recover the funds, and Binance says it is working with the FBI.

North Korea's share of hack losses

Chainalysis data published Oct. 30 shows suspected North Korea-linked hacks account for nearly 89% of reported crypto hack losses in 2026 through Oct. 29. In 2021 that share was 15%.

From 2021 through Oct. 29, 2026, reported hack losses totaled an estimated $22.34 billion. Suspected North Korea-linked attacks made up $13.24 billion of it, about 59%.

The average loss per suspected North Korea-linked incident rose from $50.65 million in 2021 to $185.65 million in 2026, about 3.7 times higher. TRM Labs, which uses a different method and time window, puts North Korea's 2026 share at around 85% and estimates $7.4 billion stolen this year alone.

Security researchers describe an operation that targets people more than code. Rafe Pilling, a senior director of threat research at Sophos, said early accounts of the Binance intrusion fit the North Korean playbook of working out how a company's systems and staff approve transfers, then exploiting that process. Michael Barnhart of the cybersecurity firm DTEX called the team among the most experienced operators in the regime's cyber programs, and said stolen money flows toward Chinese organized crime networks.

Binance co-CEO Richard Teng said the attack "was not carried out by one person," that the exchange's first theory of a compromised laptop gave way to "additional points of breach," and that the hackers used "a self-destruct mechanism that destroyed tooling and traces as they went."

Market fallout

Bitcoin fell 5% to $76,800 in Friday afternoon trading in New York. Coinbase shares dropped 12%, though the company also reported revenue slightly below expectations the same day. Robinhood fell 7.8%.

What comes next

The $2.4 billion in bitcoin and ether is the unresolved piece. Unlike stablecoins, it cannot be frozen by an issuer, and Redbord says recovery depends on the thieves moving it into regular currency, where exchanges and law enforcement could act. Binance has not said how much of the frozen total it expects to return to its own balance sheet, or when.