Tom Robinson, cofounder and chief scientist at Elliptic, a blockchain intelligence firm, called the plunder “almost certainly the single largest known theft of any kind.”

It blew past what he described as the previous largest heist, when Saddam Hussein stole $1 billion from the central bank of Iraq in 2003.

In an analysis posted to the company’s website on Friday, Robinson said his firm identified signs pointing to a North Korean-affiliated group as the culprits.

“Very few actors could coordinate an attack across 11 blockchains in around three hours,” Robinson wrote. “Most of the largest exchange and bridge hacks of recent years have been attributed to DPRK-linked actors.”

Robinson said the hackers converted about $786 million in stolen funds into coins that are more difficult to trace before much of the plunder was frozen.

Brian Armstrong, a cofounder and CEO of Coinbase, another crypto exchange platform, said on X that his company has reached out to Binance to offer assistance.

“Our team is doing everything we can to support in the current situation, including blocking sends to compromised wallets,” Armstrong said.

Armstrong said the moment calls for cooperation among rival crypto platforms.

“Crypto has been through many tough times, and has always come out stronger on the other side,” he said. “This won’t be any different.”

Changpeng Zhao, the founder of Binance and its former CEO, who remains a primary stakeholder, said on X on Friday that “token recovery has already begun.”

Zhao said he appreciated support from Binance partners around the world, including in Thailand. In a later X exchange, he got into a dust-up with Elon Musk after the latter posted a cheeky emoji.

“Elon, have a lot of respect for you, but bad time to troll. Please stop,” Zhao said. “Would appreciate if you show a little support.”

Jony Levin, the CEO of Chainalysis, a blockchain data firm, said on X that the attack carries hallmarks of infiltration by North Korean hacker groups.

“DPRK are up to their old tricks,” Levin said on X. “Industry partners have already frozen ~$3B and we @chainalysis continue to follow all of the funds.”

In a report published on Friday, the Chainalysis team said the North Korean group in question, called TraderTraitor, has repeatedly targeted crypto exchanges to “raise funds for the regime.”

Chainalysis said it was able to link the Binance breach to TraderTraitor because funds stolen from Binance were observed “commingling” with funds stolen in an earlier attack.

“That direct on-chain link strengthened our assessment that TraderTraitor carried out the Binance hack,” Chainalysis said in their report.

Anthony Scaramucci, the onetime White House communications director and now a crypto investor, took to X on Friday to laud what he described as quick, effective communication between blockchain companies after the hack.

“In the aftermath of the largest incident in crypto history, Binance’s response is what industry leadership looks like,” Scaramucci said.

Ari Redbord, global head of policy at TRM Labs, a blockchain intelligence platform, told Business Insider on Friday that the North Korean hackers are likely moving to offload their pilfered funds into the country’s weapons program.

“When North Korea steals at this scale, the money supports weapons proliferation, and every dollar we freeze or trace is a dollar the regime loses,” Redbord said in an email.

Redbord said the attackers managed to convert about $2.4 billion into relatively untraceable currencies.

“TRM is tracking those funds and alerting partners through the Beacon Network,” Redbord said.