FBI ties record $6.3 billion Binance heist to North Korea's TraderTraitor

Key points

• The FBI attributed the theft of roughly $6.36 billion in cryptocurrency from Binance to North Korea’s TraderTraitor group, also tracked as Lazarus Group, making it the largest crypto heist on record.
• Binance linked the breach to a compromised DevOps engineer’s laptop that gave attackers access to a service container for submitting unauthorized withdrawals. The theft spanned ten blockchains, and most of the funds moved within 20 minutes.
• Binance says it has covered about 95% of the stolen amount and plans to resume first-phase withdrawals on November 1 between 06:00 and 09:00 UTC.

The FBI confirmed in a security alert published Saturday that North Korean state-sponsored hackers were behind the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026. The agency attributed the attack to TraderTraitor, a group also tracked as Lazarus Group, Jade Sleet, and APT38. The official attribution follows earlier analysis by blockchain intelligence firms TRM Labs and Chainalysis, which had already linked the theft to the same actors.

Details

According to the FBI, the attackers stole approximately $6.36 billion in cryptocurrency across ten blockchains, transferring most of the funds in just 20 minutes. Binance previously linked the breach to a compromised DevOps engineer’s laptop, which allowed the attackers to reach a service container and submit unauthorized withdrawal transactions.

The FBI says it has observed TraderTraitor converting stolen assets primarily into Ethereum (ETH) and expects the funds to be further laundered through decentralized finance (DeFi) platforms and instant cryptocurrency swap services. The FBI, U.S. Secret Service, and IRS Criminal Investigation are asking cryptocurrency exchanges, blockchain operators, and other virtual asset service providers to block transactions tied to addresses the hackers used to launder the funds. The agency published a list of 628 associated cryptocurrency addresses: 608 Ethereum, 19 Bitcoin, and one Solana address.

In a statement to BleepingComputer, Binance said it was preparing to resume the first phase of withdrawals on November 1 between 06:00 and 09:00 UTC. The exchange has covered approximately 95% of the impacted amount, up from 90% in its previous update. The remaining 5% consists of less-liquid tokens it is buying through market and over-the-counter channels. BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC balances are fully backed, and deposit services remain unaffected. “Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users,” the company said.

Background

North Korean hackers have a long record of crypto theft, including the $387.5 million Bitget theft in September 2026, the $280 million Drift hack in April 2026, the $1.5 billion Bybit heist in February 2025, and the $308 million DMM Bitcoin theft in May 2024. A recurring tactic is ‘Operation DreamJob’, where attackers impersonate recruiters and lure developers and crypto employees with fake job offers into installing malware. The DMM and Bybit attacks both began by compromising employee or developer machines with access to crypto infrastructure. In the DMM case, hackers impersonated a recruiter on LinkedIn and tricked an employee of the wallet company Ginco into running malicious Python code disguised as a pre-employment test. The Bybit heist stemmed from a compromised Safe{Wallet} developer’s computer, which gave attackers access to the wallet platform and let them manipulate a legitimate transaction request, redirecting $1.5 billion to wallets they controlled. The Drift attack involved a six-month social engineering operation, with attackers posing as trading-firm representatives at multiple industry conferences. They spent months building relationships and are believed to have compromised employees’ devices through a malicious code repository or a TestFlight application.

Why it matters

For DevOps and platform engineers, this is a stark example of how a single compromised engineer laptop can cascade into the largest crypto theft on record through access to a service container and unauthorized transaction submission.

What to do

• Virtual asset service providers should review the FBI’s list of 628 addresses and block transactions linked to them.
• Watch for stolen funds being converted to ETH and laundered through DeFi platforms and instant swap services.
• Teams should treat unsolicited recruiter contact and fake job-offer lures as a documented North Korean attack vector targeting engineers with infrastructure access.