Share
Attackers the FBI ties to North Korea stole $6.36B from Binance on October 29. Our report is two reports in one: what happened, and where the stolen assets are going and what they turn into. We look at which assets the freeze stopped, what survived, what North Korea’s last theft above $1B became, and what the pattern suggests for flows from future hacks.
North Korea’s Binance heist: the scale
- $6.36B Taken from Binance hot wallets, Oct 29 (TRM Labs)
- 13.6x The theft against North Korea’s 2025 goods exports
- ~12,000 Attacker wallets on 11 chains in 3.5 days (Elliptic)
The scale of the theft: what was taken, how it compares with North Korea’s economy, and how widely the attacker spread it. Data as of Nov 4, 2026. Analysis, not investment advice.
Key findings
- Freezes caught most of the stolen stablecoins and none of the bitcoin. We show the split by asset type, and how much the attacker sold before the first freeze landed.
- We trace where the roughly 584,000 ETH and 18,270 BTC that survived are sitting, and the wallet moves that would show them heading to market.
- One token has carried more of the price risk than ETH or BTC since the hack. We measure it against four other exchange tokens.
- North Korea’s thefts are growing fast. We chart the trend and what it suggests for which assets absorb the flows from the next large hack.
Read the full report in Crypto Briefing Pro
Open the report →Crypto Briefing Pro is the newsroom’s subscriber app. Research is information, not investment advice.
