Key Highlights

● TRM Labs and Elliptic tied the reported Binance hack to North Korea.

● The firms track fund movements on public blockchains.

● The theft was about $6.3 billion.

● The attribution adds a geopolitical dimension.

Blockchain analytics firms TRM Labs and Elliptic have tied the reported hack of Binance to North Korea, according to market data. The firms track the movement of funds across public blockchains and are often among the first to identify who is behind major crypto thefts.

The attribution adds a geopolitical dimension to what is already being described as the largest crypto heist on record. Binance disclosed a breach on Thursday evening and on Friday, October 30, 2026, confirmed that about $6.3 billion to $6.36 billion had been stolen, according to reports.

Binance blamed a compromised laptop belonging to one of its DevOps engineers, according to market data. DevOps staff typically manage the systems that keep a platform running, which can give them access to sensitive infrastructure. Binance has not given further public detail on the method, based on available reports.

Freezing and recovery

The exchange and its partners moved to contain the damage. About $3 billion of the stolen funds has been frozen, according to market data. Circle Internet Group (NYSE:CRCL), the issuer of the USDC stablecoin, froze $800 million in USDC in coordination with law enforcement, according to market data

Binance pledged to cover customer losses, and withdrawals are to resume by Sunday. "We are committed to covering all hacked losses through our company funds," co-CEO Richard Teng said.

Market fallout

The reported theft weighed on crypto prices. Bitcoin fell to roughly $76,700 to $77,600, a six-week low, after trading near $86,000 earlier in October. Ether slid to about $2,237.

Crypto stocks fell hard. Coinbase Global (NASDAQ:COIN) tumbled, Strategy and Robinhood Markets (NASDAQ:HOOD) slid, and miners such as Riot Platforms (NASDAQ:RIOT) and Hut 8 (NASDAQ:HUT) moved lower. Circle's shares also fell, although no negative company-specific news was reported. A digital-assets research head said: "I suspect the negative price action still has some way to go."

The broader market was also under pressure. The S&P 500 fell 140.32 points to 7,580.07, the Dow lost 572.25 points to 51,770.31, and the Nasdaq Composite dropped 747.73 points to 25,437.00, its worst day since June 5, as Intel (NASDAQ:INTC)'s warning and Amazon (NASDAQ:AMZN)'s results set off a chip and AI selloff.

What remains unclear

Several questions remain open. It is not yet known how much of the stolen crypto that has not been frozen can be recovered, or how quickly. Binance has said it will cover losses from company funds, but the full cost to the exchange has not been detailed.

The North Korea link is based on the analytics firms' assessments, as reported. Any official statements from governments or law enforcement could add to the picture.

The episode also drew comment from Binance's co-founder. Changpeng Zhao told Elon Musk, according to market data: "Elon, have a lot of respect for you, but bad time to troll. Please stop."

What to watch

The first milestone is whether withdrawals resume by Sunday as promised. Investors will also watch for updates on frozen funds, any further attribution findings from TRM Labs and Elliptic, and statements from law enforcement.

For broader markets, Apple (NASDAQ:AAPL)'s Earnings on Monday, the midterm elections on Tuesday and the October jobs report on Friday, November 6, are next. The jobs data could reinforce expectations for a December rate hike, another pressure on crypto.