Binance theft: FBI blames North Korea's TraderTraitor
The FBI attributes the theft of more than $6 billion from Binance to North Korea's TraderTraitor. What we know, what has changed since the original post, and what you should do.
Translated from the German original with an AI language model, approved by me. Read the original
We first reported the Binance theft as an incident. Now there is a culprit, and it is a state actor: the FBI has officially attributed the theft to the North Korean group TraderTraitor. The group is also known as Jade Sleet, Pressure Chollima, Slow Pisces and UNC4899. According to The Hacker News, the US Secret Service and IRS-CI, the criminal investigation arm of the US tax agency, worked on the case alongside the FBI.
What happened
The theft took place on October 29, 2026. The FBI says more than $6 billion in virtual assets was stolen. The exact figures vary: The Hacker News reports $6.43 billion, heise cites $6.36 billion from TRM Labs, and Chainalysis put it at about $5.9 billion, according to Cointelegraph. Only the scale is certain: this is the largest crypto theft on record. The previous record was the Bybit hack in February 2025, about $1.46 billion, also attributed to TraderTraitor.
According to The Hacker News, the stolen funds sat on eleven blockchains, 82 percent of them on Ethereum and Bitcoin. Heise reports that the attackers moved most of the money out within about 20 minutes.
There is no confirmed account yet of how the attackers got in. Binance first pointed to a compromised laptop belonging to a DevOps engineer, an employee who looks after infrastructure and deployments. According to heise, Binance now believes there were several entry points and that the attack was complex.
What has changed since our post
- Official attribution: Analytics firms such as TRM Labs, Chainalysis and Elliptic were the first to point to North Korea. At first the FBI only said it was investigating. With its alert on October 31, the attribution now comes from a government agency.
- Wallet list: According to SecurityWeek, the FBI published 628 addresses: 608 on Ethereum, 19 on Bitcoin and one on Solana. It asks exchanges, DeFi services (decentralized finance services with no central operator), bridges and node operators to block transactions involving these addresses. The FBI expects the funds to be laundered further through DeFi and instant swap services.
- Frozen funds: According to Elliptic, Tether, Circle, Ripple, Arbitrum and Optimism have frozen about $2.85 billion. TRM Labs estimates $2.7 billion. The attackers converted most of the rest into Ether, which is very hard to freeze.
- Binance covers the loss: According to heise, Binance says the exchange will bear the loss, not its users, and that about 90 percent is already covered. Withdrawals resumed on November 1 and are now running on all 15 networks. On the first day, net outflows were about $3.64 billion.
Why it matters
This was no opportunistic theft. A patient, state-backed attacker looted one of the world's largest exchanges. Elliptic says this single incident almost doubles the total crypto that North Korea has stolen so far. TraderTraitor has been active since at least 2020. The group is also blamed for the attacks on DMM Bitcoin, Bybit, KelpDAO and Bitget.
Its known methods target people and developer tools. They include fake recruiters, front companies and job-themed lures. Reports from SentinelOne, Zscaler and Microsoft also describe trojanized Terraform providers. Terraform is a tool teams use to manage infrastructure as code. A tampered provider puts malicious code straight into the developer workflow. There is no proof that these exact techniques were used against Binance. But the pattern fits what Binance said about the laptop.
What you should do
If you hold crypto personally:
- Don't keep all your holdings on one exchange. Anything you aren't actively trading belongs in your own wallet, ideally a hardware wallet.
- Protect exchange accounts with hardware security keys (FIDO2/passkeys) instead of SMS codes.
- Be wary of job offers, "test assignments" and files from strangers, especially when they come through LinkedIn, Telegram or Discord.
- Watch out for phishing. Fake "compensation" sites spread after every big incident.
If you run a business or a dev team:
- If you handle crypto assets, add the FBI's address list to your transaction screening.
- Treat admin and developer machines as high-value targets. Keep work and signing environments separate, and keep privileges as tight as possible.
- Check where Terraform providers, packages and scripts come from before they reach your pipelines.
- Train HR and engineering staff to spot fake recruiters. Attackers often get in through a job interview, not through the firewall.
My take: no single tool stops a state attacker. What matters is that one compromised laptop should never be enough to move billions.