North Korea Just Pulled $6.3B Out of Binance. Stablecoin Issuers Plugged the Hole in Under an Hour

Six point three billion dollars. That's not a typo, ser.

On October 29, right around 4:20 p.m. Eastern, funds started draining out of Binance hot wallets across multiple chains. By the time anyone could slam a freeze button, we were looking at the biggest crypto theft in history, past Bybit's $1.5 billion job in 2025, past everything Mt. Gox ever fumbled. Chainalysis tracks the total at $6.4 billion. Binance says $6.3 billion. Either way, the bar just moved and it moved a lot.

How they got in

Chainalysis and TRM Labs both pinned it on TraderTraitor, the North Korean unit that's been farming exchange hacks for years now. The mechanics matter, so stay with me.

According to Chainalysis, the attacker funded an operational wallet through Tornado Cash, then used it to submit signed authorizations that let a Binance hot wallet execute attacker-deployed code. Once that code was live, the crew swept assets into addresses they controlled. Binance's own read traces the entry point to a compromised engineer's laptop, which handed the attacker access to a service container and the unauthorized withdrawals followed. The exchange says it found no evidence of a private key leak.

That's the part that should keep you up at night. Not a phished key. Not a seed phrase left in a screenshot. A laptop.

The attacker knew freezes were coming, so they raced the clock. Chainalysis says $325 million in stablecoins got swapped into $285 million of ETH in roughly twenty minutes, then another $175 million moved to stopover wallets. Look at that math for a second. Forty million dollars incinerated on slippage and routing because they had to move fast. That's the tax on doing a heist in public. And it's the reason the freezes landed at all.

By 5:14 p.m. Eastern, the wall went up. Tether's Paolo Ardoino said the company froze more than $1.567 billion in USDT. Circle's Jeremy Allaire said it locked $800 million-plus in USDC alongside law enforcement. First Digital froze the FDUSD that got lifted. Binance says roughly $3 billion is frozen onchain in total.

The people who actually stopped it

Here's the uncomfortable truth nobody in this space wants to say out loud. The security layer that saved this situation wasn't a validator set, wasn't a multisig, and definitely wasn't a governance vote. It was three phone calls to stablecoin issuers.

Tether and Circle have become crypto's de facto fire department. That's the reality. No one elected them. No one wrote it into a whitepaper. But when $6.3 billion walks out the door, they're the ones who can reach out and grab it mid-flight.

So ask yourself the question. If a hole that size gets plugged by a handful of issuers hitting pause on their own tokens, what does that say about where the actual power in this industry sits? And who audits the engineer's laptop?

On the balance sheet side, Binance says it reserved more than $6.34 billion of company funds to cover the shortfall. About $5 billion of that sits in the same token assets that got hit, and the exchange is buying the rest through market and OTC channels. An updated Proof of Reserves is coming. That's a real flex, and I'll give them credit for not blinking. But let's be honest about the structure. Five billion of the reserve is the assets they already owe you. The fresh buying is the other $1.34 billion. That's not nothing. It's also not a magic wand.

Changpeng Zhao, who no longer runs the shop but still holds a serious chunk of it, posted the most honest three-word summary of the day on X. "It does look like a hack." Thanks, chief.

Market reaction was ugly and fast. Bitcoin slid toward $76,000 Friday morning before bouncing to roughly $77,400, then settled near $76,700. Total liquidations hit $1.5 billion, with bitcoin taking $468 million and ether $358 million. Longs ate almost all of it. And the pain wasn't isolated. Polymarket suspended international trading after hackers drained more than $2.6 million from user accounts. Two separate incidents, same week. Fun.

Standard Chartered's Geoffrey Kendrick thinks there's more downside to come. His take is that a new base forms only after assets get unfrozen and the full picture of the hack surfaces. He also argued the whole thing could push traders toward decentralized exchanges.

I half agree. A DEX doesn't have an engineer's laptop that can sign arbitrary code into a hot wallet, so that's a genuine point. But let's not pretend DEXs are sacred. Polymarket got drained this week too, and it's about as onchain as it gets. The lesson isn't "CEX bad, DEX good." The lesson is that a single human endpoint can still be the whole ballgame, no matter how decentralized the settlement layer is.

What you should actually do

Anon, let me save you some gas fees.

If you're holding more on a centralized exchange than you'd shrug off losing, fix that this week. Not next month. The Bybit job was $1.5 billion and felt like a one-off. Now we've got $6.3 billion sitting on the record, and the same crew keeps showing up. This is the alpha nobody is sharing. Your bags don't care how good your thesis is if the custodian gets popped.

On price, expect chop. Unfreezing roughly $3 billion of paper back into circulation gives the market supply to digest, and Kendrick's call for more downside isn't wild. Bitcoin near $76,700 is a level worth watching. If it holds through the Proof of Reserves update, the market is telling you something. If it breaks, you already know the playbook.

One more thing. Chainalysis is already warning that scammers are impersonating the firm with fake fund-recovery offers. If anyone slides into your DMs promising to get your money back, they're farming you. The trenches don't sleep, and neither do the vultures.