The FBI has confirmed that TraderTraitor, a North Korean state-sponsored hacking group, carried out the theft of approximately $6.3 billion in cryptocurrency from Binance. The incident, which occurred on or about October 29, 2026, is being described as the largest cryptocurrency heist in history.
FBI attributes Binance theft to TraderTraitor
In a security alert issued Saturday, the FBI attributed the attack to TraderTraitor, a group also tracked as Lazarus Group, Jade Sleet, and APT38. The group has been linked to numerous cryptocurrency thefts.
“The Federal Bureau of Investigation (FBI) has released information advising that the Democratic People’s Republic of Korea (North Korea) is responsible for the theft of over $6 billion in virtual assets from the cryptocurrency exchange Binance on or about October 29, 2026,” the FBI said.
The official attribution follows earlier findings by blockchain intelligence companies TRM Labs and Chaineries, which had also linked the incident to TraderTraitor.
Binance previously said the breach originated from a DevOps engineer’s laptop. The compromise allowed the attackers to access a service container and submit fraudulent withdrawal transactions.
The attackers stole approximately $6.36 billion in cryptocurrency across 10 blockchains, with most of the funds transferred within 20 minutes.
FBI publishes cryptocurrency addresses
The FBI said it observed TraderTraitor converting the stolen assets primarily into Ethereum (ETH). The agency expects the funds to be further laundered through decentralized finance (DeFi) platforms and instant cryptocurrency swap services.
The FBI, U.S. Secret Service, and IRS Criminal Investigation are asking cryptocurrency exchanges, blockchain operators, and other virtual asset service providers to block transactions associated with addresses used to launder the stolen funds.
The agency also published a list of 628 cryptocurrency addresses linked to the theft. The list includes 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address.
TraderTraitor’s history of cryptocurrency attacks
TraderTraitor has a long history of targeting cryptocurrency companies and their employees. North Korean hackers were responsible for the $387.5 million Bitget theft in September 2026 and two thefts in April 2026. The group has also been linked to the $80 million Drift hack, the $1.5 billion Bybit heist in February 2025, and the $308 million DMM Bitcoin theft in May 2024.
One tactic used by North Korean Lazarus hackers is a long-running campaign known as “Operation DreamJob.” In these attacks, hackers impersonate recruiters and offer fake jobs to software developers and cryptocurrency employees, attempting to trick them into installing malware.
Both the DMM Bitcoin and Bybit attacks involved compromising the computers of employees or developers who had access to cryptocurrency infrastructure.
In the DMM Bitcoin attack, a hacker posed as a LinkedIn recruiter and persuaded an employee of cryptocurrency wallet company Ginco to run malicious Python code disguised as a pre-employment test.
The Bybit heist began with the compromise of computers used by a Safe{Wallet} developer. The attackers then gained access to the wallet platform and manipulated legitimate transaction requests by DMM employees, redirecting $1.5 billion in cryptocurrency to wallets they controlled.
More recently, the April 2026 Drift attack involved a six-month social engineering campaign. Individuals posing as representatives of cryptocurrency trading companies met Drift contributors in person at multiple industry conferences.
The attackers are believed to have spent months building relationships and compromising employee devices through malicious code repositories and the TestFlight application.
Binance prepares to resume withdrawals
In a statement shared with BleepingComputer today, Binance said it continues to restore services and compensate for stolen assets. The exchange said it was preparing to resume the first phase of withdrawals between 06:00 and 09:00 UTC on November 1.
Binance said it now covers approximately 95% of the impact, up from 90% in its previous update. The remaining 5% consists of illiquid tokens, which the exchange continues to purchase through its marketplace and over-the-counter channels.
The exchange also said that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC balances are fully backed, while deposit services remain unaffected by the incident.
“Our commitment remains the same. The financial impact of stolen funds will be borne by Binance. These losses will not be passed on to our users,” Binance told BleepingComputer.
“Resuming withdrawals is a major milestone, but our efforts continue. We will continue to strengthen safety measures, complete the withdrawal process, and provide updates as we progress.”
Source: www.bleepingcomputer.com
