Chainalysis and TRM Labs linked the Binance breach to TraderTraitor, a unit associated with North Korea, while Chainalysis assessed the theft at $6.4 billion and Binance reported about $6.3 billion in affected assets. If confirmed at that scale, it would be the largest recorded crypto hack, surpassing the $1.5 billion Bybit theft in 2025 that Binance attributed to North Korean hackers. Chainalysis said funds began leaving Binance hot wallets at about 4:20 p.m. Eastern Time on October 29 after an attacker used an operational wallet funded through Tornado Cash to submit signed authorizations and execute attacker-deployed code. Binance said a compromised engineer laptop exposed a service container, but found no evidence of a wallet private-key leak. The attacker converted $325 million in stablecoins into $285 million of ether in roughly 20 minutes and sent another $175 million to stopover wallets as freezes began by 5:14 p.m. Stablecoin issuers froze more than $2.3 billion combined in USDT and USDC, while Binance said about $3 billion was frozen onchain. The exchange reserved more than $6.34 billion to cover the incident and plans to publish an updated Proof of Reserves. The breach coincided with a separate $2.6 million-plus theft at Polymarket and a crypto sell-off that produced $1.5 billion in liquidations. Bitcoin traded near $76,700 at the time of writing. Standard Chartered's Geoffrey Kendrick said prices could face further pressure before a new base forms as assets are unfrozen and more details emerge. Chainalysis also warned about impersonators offering fraudulent recovery services.