Editor’s Note: An attacker drained about $6.3 billion in cryptocurrency from hot wallets at the exchange Binance on Oct. 29, 2026, the largest cryptocurrency theft on record. Blockchain analytics firms TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean hacking group, and Elliptic calls that attribution likely. North Korea denies using state-linked cyber units for theft. No government had confirmed responsibility as of Oct. 31, and the FBI and Secret Service have described only investigative and recovery work. Stablecoin issuers including Tether and Circle froze over 40 percent of the stolen funds within hours.

Binance has pledged to cover all losses and says it has bought replacements for 90 percent of the stolen assets, which is not the same as recovering them. Lawyers quoted by CoinDesk said a freeze does not decide who owns the tokens and that recovery could require court orders in several jurisdictions.

For compliance and eDiscovery professionals, the blocking rule in the North Korea sanctions regulations does not wait for an official attribution, and exchange records could help establish ownership. Watch for Binance’s technical findings, the reopening of withdrawals and any U.S. attribution.


Content Assessment: With over 40 percent of the record Binance theft frozen, getting it back becomes a legal project

Information - 93%
Insight - 93%
Relevance - 95%
Objectivity - 92%
Authority - 90%

93%

Excellent

A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "With over 40 percent of the record Binance theft frozen, getting it back becomes a legal project."


News Analysis – Cybersecurity Beat

With over 40 percent of the record Binance theft frozen, getting it back becomes a legal project

ComplexDiscovery Staff

An attacker drained about $6.3 billion from Binance hot wallets on Oct. 29, the largest cryptocurrency theft on record, and three blockchain analytics firms have linked it to North Korea’s TraderTraitor hacking group. Within hours, stablecoin issuers froze over 40 percent of the haul, and what follows is a recovery effort that depends on proof of ownership, legal process and forensic traces that Binance says the attacker destroyed as it went.

No government had confirmed who carried out the attack as of Oct. 31, based on Elliptic’s latest update and the official statements reviewed for this article. That gap shapes the story, but as the sanctions rules discussed below show, it does not pause anyone’s compliance obligations.



How the theft unfolded in about 20 minutes

The public account of how the attack unfolded comes from Binance and the firms tracing its money. Binance said its hot wallets, the internet-connected wallets exchanges draw on to pay out customer withdrawals, were compromised at about 20:05 UTC (4:05 p.m. EDT) on Thursday, Oct. 29. TRM Labs, which traced the outflows, said most of the money left in about 20 minutes across 10 blockchains, starting with five Binance wallets on the XRP Ledger. Elliptic counted 11 affected chains, and its list includes NEAR, a network TRM’s account does not name.

On Ethereum, according to TRM and Elliptic, the attacker submitted one transaction carrying 50 pre-signed authorizations under EIP-7702, a 2025 Ethereum feature that lets an ordinary wallet hand its behavior to a smart contract. Each authorization covered a different transaction count, so one was bound to match the hot wallet’s count when the transaction landed, and that match turned the wallet into a sweeper only the attacker could command. Binance wallets on other chains paid out by way of routine signed transfers in the same window, which led TRM to assess that the attacker could direct Binance’s signing system to approve whatever transactions it wanted. TRM, which sells monitoring tools, advised treasury teams to alert on any EIP-7702 delegation appearing on a treasury wallet and to split signing infrastructure along chain and wallet-tier lines.

Binance’s own account has widened with its investigation. The exchange first pointed to a compromised engineer’s laptop, then said in an Oct. 30 update that it had uncovered “additional points of breach” and had seen nothing indicating its wallet private keys were exposed. Richard Teng, one of Binance’s two co-chief executives, said in a video transcript posted to X the same day that the delegation “did not pass through our normal approval controls.”

Attribution rests with private analysts, not governments

On who was behind it, the tracing firms have gone further than any government. TRM attributed the attack to TraderTraitor with what it called high confidence. Chainalysis reached the same conclusion, saying funds stolen from Binance had commingled on-chain with proceeds of September’s theft from the exchange Bitget, which had been attributed to North Korea. Elliptic was more guarded, writing that TraderTraitor was “likely” responsible. Its reasons for caution: the overlap with Bitget funds is small, a laundering network can serve several clients, and the attacker converted stablecoins more slowly than North Korean groups usually do. North Korea denies using state-linked cyber units for financial theft, and neither its Geneva mission nor its embassy in China answered Reuters’ requests for comment.

U.S. officials have not gone as far as the firms. “The FBI is aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts and coordinate appropriate investigative steps,” the bureau told Nextgov/FCW on Oct. 30. Elliptic noted that the FBI attributed the 2025 Bybit theft to North Korea within five days. Asked Oct. 30 whether North Korea was responsible this time, President Donald Trump said he did not know but that his administration was looking into it, Reuters reported.

Binance is also working with the U.S. Secret Service, according to a person familiar with the situation cited by Reuters. The Secret Service told Reuters that its investigators “are working around the clock with our private-sector partners, including Circle, to identify, freeze, trace and recover funds stolen from Binance on Thursday.” Neither the FBI’s statement nor the Secret Service’s says who carried out the attack. Abu Dhabi’s Financial Services Regulatory Authority, the regulator behind Binance’s main operating license, has spoken only to oversight, saying it was “engaging closely with Binance and monitoring the incident,” according to Reuters.

Why the Binance loss runs from $6.3 billion to $6.43 billion

The tracing firms also differ on the size of the loss, and the headline figure depends on who is counting. Binance estimated its loss at about $6.3 billion, while TRM put it at about $6.36 billion, Chainalysis at about $6.4 billion and Elliptic at $6.43 billion. TRM and Elliptic both say they valued each transfer at the asset’s price when it left Binance, and TRM added that the same assets were worth about $6.23 billion at prices as of 00:30 UTC on Oct. 30. Elliptic’s total also leaves out $169 million that moved after the withdrawal halt, transfers the firm believes were Binance shifting its own money. Neither Binance’s update nor the Chainalysis post states a valuation basis.

The frozen figure moves faster still. TRM counted about $2.7 billion as of 00:30 UTC on Oct. 30. Most of it was about $2.67 billion in stablecoins frozen by Tether, Circle, Ripple and World Liberty Financial, and the remaining roughly $30 million was in assets the Arbitrum network’s Security Council moved out of the attacker’s reach. Chainalysis reported about $2.8 billion, though as of Oct. 31 its post still showed the timestamp as a bracketed “[time]” placeholder. Elliptic counted $2.85 billion frozen or seized as of about 04:30 UTC on Oct. 31, or 44 percent of its total, and Binance put the figure at about $3 billion. Anyone citing these numbers in a memo or a filing should name the source and the timestamp, because each is a snapshot of a moving balance.

A freeze stops the money but does not return it

Whatever the frozen total turns out to be, Binance has said its customers will not bear the loss. Its Oct. 30 update said the exchange would cover all stolen funds through its Secure Asset Fund for Users and its corporate treasury, and that it had set aside over $6.34 billion to do so. An Oct. 31 update said Binance had replenished 90 percent of the stolen assets by buying replacements with its corporate treasury and part of its futures insurance fund. It said it was deploying part of its Secure Asset Fund for Users to acquire the rest, and a later Binance post on X said that transfer, 7,499 bitcoin, was complete. Those are replacement purchases, not recovered funds. Withdrawals were still closed as of the Oct. 31 update, which said Binance remained on track to reopen them on Sunday, Nov. 1.

Teng said customer funds “are not impacted” and that “what was affected in this incident was Binance’s own hot wallet.” A CoinDesk review of Binance’s reserve data found that the drained wallets are among those the exchange counts toward customer balances. Using Binance’s Oct. 1 reserve figures, CoinDesk estimated that the theft could have left ether backing about 6 percent below customer holdings until replacements were bought. One possible reconciliation is that the wallets belong to Binance while their contents back what customers are owed, though neither account settles who legally owns those contents. Binance’s Oct. 31 update said ether and nine other tokens it listed were again fully backed, a claim users can check against a full proof-of-reserves report the exchange expects by Nov. 3. None of the Binance statements reviewed for this article says which Binance entity would claim the frozen tokens.

The path back to those tokens is not automatic. “Freezing the USDT and USDC is only the first step,” Irina Heaver, founder of the Dubai-based firm NEOSLegal, told CoinDesk. She said an issuer can void frozen tokens and issue new ones, a process that does not always need a court judgment but does depend on proving ownership and a legal basis for handing the tokens back.

Other lawyers quoted by CoinDesk drew the same line between stopping funds and owning them. Max Atallah, managing partner at Nordic Law, said issuers freeze under contractual powers, sanctions obligations or requests from authorities, adding, “A freeze does not in itself determine who is entitled to the assets.” Alexander Shirtcliff, head of commercial disputes at the law firm Edwin Coe, said recovery could require court orders in several jurisdictions if assets reach other exchanges or custodians.

Atallah’s point about the grounds for a freeze applies here, because the issuers have described theirs differently. TRM reported that Circle froze 823 million USDC in coordination with law enforcement. Circle Chief Executive Jeremy Allaire separately said on X that Circle had frozen over 800 million USDC in coordination with law enforcement, according to CoinDesk. Tether Chief Executive Paolo Ardoino confirmed freezes of over 1.567 billion USDT, but CoinDesk reported that the post was silent on whether law enforcement had directed the freeze. The rest of the haul sits beyond any issuer’s reach. Elliptic estimated that the attacker controlled about $3.21 billion in assets such as ether and bitcoin that no issuer can freeze, funds that can now be halted only once they surface at an exchange or similar service.

The records that prove who moved what

For the frozen portion, establishing ownership means showing which transfers were unauthorized, and much of that evidence sits inside Binance’s own systems. Teng said the attacker “used a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for us to trace and investigate.” Binance said it expected to share more technical findings within about 48 hours of its Oct. 30 update, once they were verified and if disclosure would not compromise investigative efforts, followed later by a full postmortem report.

None of the public statements reviewed for this article, including Binance’s Oct. 30 update, Teng’s transcript, a Binance spokesperson’s statement to TechCrunch and the FBI’s statement to Nextgov, says whether any authority has asked Binance to preserve records. For counsel at exchanges, custodians and stablecoin issuers that received or froze traceable funds, the first step is to assess whether a duty to preserve has attached. If it has, a litigation hold should reach the custodians and data sources tied to those transactions, meaning deposit records, screening alerts, freeze instructions and the communications behind them. Records like those could help establish the ownership and legal basis for return that Heaver described.

Screening obligations arrive in the same week

Sanctions law adds a second legal layer. The theft came one day after the Treasury Department’s Office of Foreign Assets Control (OFAC) designated 10 individuals and one entity on Oct. 28 for roles in North Korean IT worker schemes. The designated entity, the First Financial and Technical Development Center, is listed in Vladivostok, Russia, and the entries for three of the individuals include cryptocurrency addresses. The designations were announced before the theft and do not concern Binance, and OFAC’s recent actions page listed no action tied to the theft as of Oct. 31.

Treasury’s Oct. 28 release states that “OFAC may impose civil penalties for sanctions violations on a strict liability basis.” Separately, the North Korea Sanctions Regulations block property and interests in property of the Government of North Korea or the Workers’ Party of Korea. The rule reaches such property that is in or comes within the United States, or that is or comes within the possession or control of a U.S. person. Notes in the regulations say that blocking applies whether or not the property’s owner appears on OFAC’s sanctions list, and the regulations define the government to include anyone acting for or on its behalf. OFAC guidance likewise tells holders who identify wallets they believe are owned by or associated with a sanctioned party to block the digital currency and report it.

Compliance teams therefore cannot treat an official attribution as the trigger. Deciding whether traceable funds are blocked property, including whether they sit within U.S. jurisdiction and whether any OFAC license applies, falls to them now. To support that work, TRM urged exchanges and compliance teams to screen deposits against the attacker addresses it has labeled, and Elliptic released a free list of over 1,000 addresses it ties to the theft. Both firms sell the screening tools their posts promote.

Tether froze the attacker’s main receiving wallet 37 minutes after the main sweep, according to TRM, while Elliptic noted that laundering the Bybit proceeds took months. The freeze was the fast part. With over 40 percent of the money locked, the attribution unconfirmed and part of the forensic trail destroyed by Binance’s account, which records will your organization be able to produce when someone asks whose tokens these are?



News Sources



Assisted by GAI and LLM Technologies

Additional reading

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.

 

Have a Request?

If you have information or offering requests that you would like to ask us about, please let us know, and we will make our response to you a priority.

ComplexDiscovery OÜ is an independent digital publication and research organization based in Tallinn, Estonia. ComplexDiscovery covers cybersecurity, data privacy, regulatory compliance, and eDiscovery, with reporting that connects legal and business technology developments—including high-growth startup trends—to international business, policy, and global security dynamics. Focusing on technology and risk issues shaped by cross-border regulation and geopolitical complexity, ComplexDiscovery delivers editorial coverage, original analysis, and curated briefings for a global audience of legal, compliance, security, and technology professionals. Learn more at ComplexDiscovery.com.

 

Generative Artificial Intelligence and Large Language Model Use

ComplexDiscovery OÜ recognizes the value of GAI and LLM tools in streamlining content creation processes and enhancing the overall quality of its research, writing, and editing efforts. To this end, ComplexDiscovery OÜ regularly employs GAI tools, including ChatGPT, Claude, Gemini, Grammarly, Midjourney, and Perplexity, to assist, augment, and accelerate the development and publication of both new and revised content in posts and pages published (initiated in late 2022).