Binance hack alone outweighs North Korea's entire crypto theft record before it

Willie Sutton, the American bank robber, reportedly explained his choice of target with a line that has outlived him: "Because that's where the money is." Nearly a century later, the line fits North Korea's crypto hacking apparatus rather well. According to figures published on October 30 by the data account unfolded, the country has extracted roughly $9.6 billion in cryptocurrency since 2019 — and a single operation, the Binance breach of October 29, accounts for about two-thirds of it.

Binance's hot wallets were emptied in a matter of minutes starting around 21:05 Paris time, with funds drained across roughly ten blockchains. TRM Labs said "with a high degree of confidence" that most of the stolen assets left the exchange within about 20 minutes. The attacker exploited EIP-7702, an Ethereum feature activated in May 2025 that allows accounts to delegate execution, submitting 50 pre-signed authorizations to move funds. In the process, 167,464 ETH and 1.6 billion USDT left Binance in a single stretch.

Binance has attributed the breach to a compromised computer belonging to a DevOps engineer, saying no private key was reportedly leaked. The exchange's own estimate of the loss stands at approximately $6.3 billion, close to the $6.4 billion calculated by Chainalysis and the $6.36 billion TRM Labs recorded at the time of the hack.

Bigger than the previous nine hacks combined

To put the scale in context, unfolded's calculations show that the nine largest crypto hacks in history before this one — a list running from Mt. Gox to FTX and including last year's Bybit breach — add up to $5.4 billion combined. The Binance hack exceeds that entire combined total by roughly $1 billion on its own.

Strip out Binance, and North Korea's remaining haul across six years comes to $3.2 billion. That figure includes the $49 million Upbit hack in 2019, the $624 million Ronin bridge breach tied to Axie Infinity in 2022, the $1.4 billion Bybit hack in February 2025 — laundered within roughly ten days, largely through THORChain, according to the brief's figures — plus more recent incidents: $295 million from Drift and $293 million from Kelp DAO in 2026, and a $387 million hack of Bitget last month. Elliptic noted a $39,000 overlap between funds from the Bitget and Binance incidents on a shared address used for attribution, and Chainalysis attributes the Binance attack to TraderTraitor, a North Korean cell linked to the Lazarus Group, calling the link "probable" in Elliptic's assessment.

Stablecoin issuers moved to freeze funds

Issuers acted quickly to lock down stolen stablecoins. Tether froze approximately 1.77 billion USDT, Circle blocked 823 million USDC, Ripple froze 40.5 million RLUSD, and World Liberty Financial locked 27.8 million USD1. Arbitrum's security council separately blocked 8,426 ETH. Elliptic counts total frozen funds at $2.84 billion, or 44% of the loot, while Binance's own figure for frozen assets runs closer to $3 billion.

The hacker also borrowed approximately 19,760 ETH on Aave and moved 18,270 BTC using a peel chain technique to obscure the trail. Elliptic estimates that $3.3 billion remains out of reach, spread across roughly forty addresses. Binance has suspended deposits and withdrawals on several networks and says it will cover all client losses through its SAFU fund and its own resources.