TLDRTRM Labs linked the $6.3 billion Binance hack to North Korea’s TraderTraitor unit, part of the Lazarus Group.Most stolen funds moved across ten blockchains in about 20 minutes on October 29.Tether and Circle froze about $2.4 billion in stablecoins, and Binance reported $3 billion frozen in total.Binance pledged to cover losses and expects withdrawals to resume within 48 hours.Crypto liquidations reached $1.53 billion in 24 hours as Bitcoin dipped to about $76,460.Blockchain investigators have linked a $6.3 billion hack of Binance to North Korea’s Lazarus Group. The theft took place on October 29 and is the largest crypto hack on record, according to Blockaid.TRM Labs said it tied the attack with high confidence to TraderTraitor, a North Korean unit connected to Lazarus. Blockchain investigator ZachXBT also named Lazarus as the likely attacker, but Binance has not confirmed who was behind it.The FBI previously named TraderTraitor as responsible for the February 2025 Bybit theft, which drained about $1.5 billion. U.S. authorities say North Korea steals crypto to help fund its weapons programs.How the Binance Hack UnfoldedTRM traced about $6.36 billion leaving Binance wallets across ten blockchains, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger. Most of the funds moved in about 20 minutes, starting at 20:05 UTC.Around $3.79 billion moved on Ethereum. Bitcoin and Tron accounted for $1.47 billion and $628 million. About 233.46 million XRP, worth nearly $296 million, left five Binance wallets before the Ethereum attack began.TRM said preparations started at least 36 hours earlier. A wallet controlled by the attacker received small Tornado Cash withdrawals and tested malicious code.Blockaid found an Ethereum transaction with 50 EIP-7702 authorizations aimed at Binance 14, one of the exchange’s busiest hot wallets. Only one succeeded, which let a malicious contract move funds out.“The attacker effectively reprogrammed a major Binance Ethereum hot wallet so that a single operator could drain it, including any new money deposited into it,” Blockaid CEO Ido Ben-Natan told crypto.news. About $2.5 billion was taken from that wallet alone.Binance said its early findings point to a compromised laptop belonging to a DevOps engineer. The exchange said it found no evidence of leaked private keys.Tether froze more than 1.567 billion USDT, and Circle froze over 800 million USDC. Binance said about $3 billion in assets have been frozen in total.Onchain Lens reported the attacker still holds about 480,720 ETH, worth roughly $1.08 billion, which cannot be frozen by an issuer. The attacker recently moved 17,260 ETH to a new wallet.BINANCE HACKER PREPARING TO LAUNDER FUNDSThe hacker just moved 17.26K $ETH ($38.82M) to a new wallet, preparing to launder funds via Tornado Cash and other mixers.The attacker still holds 480.72K $ETH (~$1.08B) that cannot be frozen.New wallet:… pic.twitter.com/FmG18g85hT— Onchain Lens (@OnchainLens) October 30, 2026Binance pledged to cover customer losses with its SAFU fund and company resources. Deposits remain open, but withdrawals are paused while systems are upgraded, with a restart expected within 48 hours.Crypto Liquidations Top $1.5 BillionTraders faced $1.53 billion in forced liquidations over 24 hours, according to CoinGlass. Long positions made up about $1.29 billion, or 83.8% of the total.Bitcoin positions accounted for about $499 million in liquidations, and ether followed with $358 million. Binance alone recorded $754.6 million, or 49.2% of all forced closures.Bitcoin fell as low as about $76,460, near its 200-day moving average of $76,457. Ether dipped below $2,200, and Bitcoin is on track for a monthly loss of about 8%.Analysts cited support at $75,545, with $70,000 as the next level below.Prices have since started to recover, with Bitcoin moving toward $78,500 and ether trading near $2,240. In the latest hour, short positions made up $20.6 million of $21.6 million in liquidations.The post Binance Hack Linked to North Korea’s Lazarus Group as Crypto Liquidations Top $1.5 Billion appeared first on Blockonomi.