A crypto payment deserves more attention than whether the amount is correct. Chainalysis attributes approximately $6.4 billion in unauthorized transfers from Binance on October 29, 2026, to a North Korean cybercrime group. For anyone accepting crypto, the practical concern is how stolen funds move onward and what happens when attempts to freeze them catch up.
A stable price does not mean unrestricted funds
Part of the stolen balance was held in USDT and USDC, stablecoins designed to track the value of a reference currency. Their issuers can freeze tokens. That makes the history of an incoming payment relevant even when its price looks reassuringly predictable.
Freezes began by 5:14 p.m. Eastern Time on October 29, and approximately $2.8 billion has been frozen. But freezing stolen assets is not the same as returning money to affected users. Do not treat a frozen total as an announcement that individual balances have been restored.
The theft involved Binance hot wallets, wallets connected to the internet for moving funds. For someone keeping money on an exchange, this is a separate risk from accepting a questionable payment: the platform holding the funds can itself become the target.
Changing the asset does not settle questions about its origin
The attacker moved $500 million in stablecoins into a wallet used for swaps. Over nearly 20 minutes, it exchanged $325 million in stablecoins for $285 million in ETH, the native cryptocurrency of Ethereum. The remaining $175 million in stablecoins later moved to intermediary wallets.
The purpose was to get ahead of freezes by exchanging assets that issuers could block for assets outside that control. Bitcoin and ETH do not have a stablecoin issuer that can freeze them in the same way.
For an individual buyer, that distinction matters. “This coin cannot be frozen by an issuer” is not equivalent to “this payment has a safe history.” Changing the asset changes the freezing mechanism, not the question of where the money came from. Do not accept that claim as a substitute for checking a proposed payment.
Look for connections, not a single suspicious-looking transfer
The attribution to TraderTraitor, a North Korean cybercrime group, rests partly on funds from the Binance theft mixing with funds stolen from Bitget the previous month. Connections recorded on blockchains, the shared transaction records used by cryptocurrencies, helped link the incidents.
Investigators also observed thousands of transfers and repeated circulation between addresses. Many addresses first received exactly 1 TRX, the native cryptocurrency of the TRON network, before receiving and forwarding other funds. These patterns suggest automated movement of stolen assets.
That is not a reason to label every small TRX transfer criminal. The meaningful signal is the wider transaction history and its connections, not one amount viewed in isolation.
Make the check part of deciding whether to accept payment
If you are selling crypto directly to another person or receiving payment for freelance work, ask for the sending address before agreeing to proceed. Use an AML check, a screening for links to money laundering and other illicit activity, to assess the proposed wallet or transaction.
If concerning connections appear, pause rather than relying on an explanation that the funds have already passed through several wallets. Keep the address, transaction identifier and payment correspondence. The investigation is ongoing, and address labels can change as new connections are identified; a check is a decision aid, not a permanent guarantee.
What this means for you
Evaluate both where you keep crypto and where incoming payments originate. A familiar token name or a completed transfer does not answer every question about the funds’ history.
Before sending or accepting funds, check the wallet or transaction with AML Verifier. Pay per check, with no subscription, on the website or in the Telegram Mini App.