North Korea took $6 billion from Binance. The part nobody can freeze is the part to watch.

The biggest theft in crypto history took about twenty minutes. What happens to the $2.4 billion still in the hackers' wallets decides whether it becomes money North Korea can spend.

At 20:05 UTC on October 29, money started leaving Binance, the world's largest crypto exchange. By TRM Labs' count about $6.36 billion went out across ten blockchains, most of it in about twenty minutes. Binance puts its loss at about $6.3 billion. Chainalysis calls it the largest theft in crypto history, and it is about four times the $1.5 billion taken from Bybit in February 2025.

It was not a smash and grab. TRM says preparation began at least 36 hours earlier. Elliptic says the attacker did not steal Binance's private keys but got Binance's own systems to sign the transactions. Binance first pointed to a compromised engineer's laptop, then said its investigation had found additional points of breach. It has not published a root cause.

On October 31 the FBI said North Korea was responsible, and named the activity TraderTraitor, the same name it gave the Bybit theft. North Korea calls that a grave political provocation.

Binance stopped withdrawals while it checked its systems, and says it will absorb the financial impact, not its users. It set aside more than $6.34 billion of company money, drew on part of its emergency fund for users, known as SAFU, and has pledged to refill that fund to about $1 billion. The SAFU wallet is public.

When withdrawals reopened on November 1, customers took out $4.649 billion and put in $1.01 billion in about nine and a half hours, a net outflow of about $3.64 billion by Binance's own count. A second phase of withdrawals began on November 3.

Some crypto has an issuer, a company that can stop a token from moving. Stablecoins do. Within hours Tether froze about 1.77 billion USDT and Circle about 825 million USDC, and smaller issuers and the Arbitrum Security Council froze about $100 million more. That is nearly $2.7 billion, about 42 percent of the theft, in TRM's count.

Ether and bitcoin have no issuer. Nobody can switch them off. As of October 30 the attacker still had more than 420,000 ETH and 18,270 BTC, about $2.4 billion. That is the part of the theft that is still in play.

A theft is not revenue until it is turned into cash. The pattern is documented. The 11-country Multilateral Sanctions Monitoring Team found that North Korea relied heavily on over-the-counter traders in China to convert stolen crypto into ordinary currency. TRM describes Chinese brokers that buy stolen funds at a discount, and expects this money to pass through bridges, swap services and those brokers. Speed varies: at least $160 million of the Bybit proceeds moved within 48 hours, while some stolen funds sit for weeks.

The US government says these thefts generate revenue for North Korea's weapons of mass destruction and ballistic missile programs. The monitoring team says North Korea uses its hackers to get around UN sanctions. In 2024 one UN member state told the UN's panel of experts that hacking brings in about 50 percent of North Korea's foreign currency income. That is one country's claim, not the panel's finding.

Read the first two together. The FBI has asked the industry to refuse the hackers' addresses, and TRM says the laundering that would need those services had not started. The last two are the denials: one total, one partial.

This is not the first record. The FBI tied North Korea to the $620 million Ronin theft in 2022 and the $1.5 billion Bybit theft in 2025. Chainalysis attributes the $305 million DMM Bitcoin theft in 2024 and $387 million from Bitget in September 2026. In TRM's data, North Korea has taken about $12.8 billion since 2017, and $7.4 billion of it this year.

The FBI alert lists the addresses holding or that have held assets from the theft: several hundred on Ethereum, 19 on bitcoin and one on Solana. Anyone can watch them. If the $2.4 billion starts moving through bridges, swaps and brokers, the cash-out has begun. If it sits still, it is still crypto that North Korea cannot spend.

Three things. First, the freeze worked exactly where it could. Every dollar that was frozen sat in a token with a company behind it, and those companies acted within hours. The money that got away is the money with no one to call. That is the design of ether and bitcoin, and it is why this theft will be measured by the wallets, not the headlines.

Second, the theft and the payoff are two separate events. October 29 took the money. Turning it into currency is a second job, and it runs through a small number of brokers, mostly in China, that sanctions monitors have named for years. That step is slower and more exposed than the hack, and it is where the $2.4 billion either becomes revenue or stays stuck.

Third, Binance says it has absorbed the loss and its customers will not pay for it. The cost now sits with Binance's own funds and the emergency fund it has promised to refill. The size of the theft did not break the exchange. The speed of the cash-out decides what it means for everyone else.