FBI Pins Record Binance Crypto Theft on North Korea's TraderTraitor Group

The FBI has formally blamed a North Korean state-aligned hacking group known as TraderTraitor for stealing more than $6 billion in digital assets from Binance, the world's largest cryptocurrency exchange. The FBI made the attribution together with the U.S. Secret Service and the IRS Criminal Investigation unit. It follows earlier reporting in which blockchain intelligence firm TRM Labs tied the attack to the same group. Binance paused all withdrawals after the hack came to light late on a Thursday. It has since begun a phased restart, while it works out how to cover a loss the industry calls the biggest crypto theft in history.

What happened

According to Binance, an early investigation pointed to the compromise of one engineer's laptop. That foothold let the attackers move funds out of the platform. The following morning, the exchange said further digging had "uncovered additional points of breach." It did not describe those additional entry points publicly. Binance says it is working with law enforcement.

The exchange first put the "estimated total impact" at about $6.3 billion. The figure tied to TraderTraitor in later reporting on the FBI's statement is $6.43 billion. The stolen funds were spread across 11 blockchains, and 82% of the value sat on Ethereum and Bitcoin.

Part of the haul has been frozen. A blockchain transaction cannot be reversed, but some token issuers and networks can lock specific tokens so they can no longer be moved. The two reports give slightly different figures:

• Binance said roughly $3 billion of affected assets were frozen. Most of these were stablecoins, which are tokens pegged to a currency such as the U.S. dollar.
• Later reporting put the frozen amount at $2.85 billion. Tether, Circle, Ripple, Arbitrum and Optimism carried out those freezes on-chain.

Blockchain analytics firm Elliptic said the attacker had swapped about $3.3 billion into assets that cannot be frozen and was trying to turn them into conventional money. The FBI said it has watched the group convert stolen funds mainly into Ether (ETH). It expects the attackers to launder the money further through decentralised finance (DeFi) services and "instant swap" services. Instant swaps are quick exchange services that trade one token for another, often with little identity checking. The FBI also published a list of wallet addresses it says the attackers are using to launder the funds.

On the money side, Binance said it had set aside more than $6.34 billion of company funds to cover the incident. About $5 billion of that is already held in the exact tokens that were stolen. The exchange said it is buying the remaining tokens on the market. It warned this could take time, because some tokens are thinly traded and settlement is slow.

Co-founder Changpeng Zhao (CZ) estimated that about $2 billion still has to be covered. He noted that the company owns more than $1 billion in SpaceX shares. On X, he wrote that the remaining gap is "(still painful, but) manageable." Co-chief executive Yi He said Binance's annual revenue is enough to absorb the loss. CZ has previously put that revenue at about $5 billion a year.

Binance has since started "phase one" of restoring withdrawals, in a window between 6 and 9 a.m. UTC. It says further services will return as security and readiness checks are completed. Deposits stayed open throughout.

Who is affected

The direct victim is Binance and its customer base. The exchange holds roughly $140 billion in digital assets. Customers were cut off from withdrawals for a period. Binance co-CEO Richard Teng told them their money is safe and that every loss will be covered. He said the money would come from a reserve fund, which held about $1 billion in bitcoin as of mid-October, plus company funds.

The regulatory picture is spread across several jurisdictions. Abu Dhabi's Financial Services Regulatory Authority supervises Binance's main global exchange and said it is "engaging closely" with the company. In the U.S., Binance runs a separate entity that is registered with FinCEN and licensed as a money transmitter in 32 states. The sources do not say whether that entity was touched by the breach.

The wider market felt it too. Bitcoin fell about 4% after news of the hack broke, then recovered to trade above $78,000.

Beyond Binance, TraderTraitor's recent campaigns have targeted people working in cybersecurity, AI, blockchain and talent recruitment. Its malware runs on macOS, Linux and Windows.

How it works

The sources do not explain exactly how the engineer's laptop at Binance was compromised. They do describe how TraderTraitor usually operates. The group has been active since at least 2020. Other security firms track it under several names: Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899. It has previously been linked to thefts from DMM Bitcoin, Bybit, KelpDAO and Bitget.

Its standard approach is social engineering, meaning it tricks a person rather than breaking software directly. The steps are:

1. The lure. The attackers set up front companies, convincing websites and social media profiles, and pose as recruiters. Microsoft described one case where the group impersonated an AI-powered blockchain intelligence firm. It offered software engineering jobs and booked interviews with people who replied. Researchers say AI tools now help the group write lures and build fake personas.
2. The poisoned tool. At some point the target is persuaded to run code. Recently the group has hidden malware inside trojanized Terraform providers. Terraform is a widely used tool for managing cloud infrastructure, and "providers" are plug-ins that extend it. A trojanized provider looks legitimate but carries hidden malicious code.
3. The payload. The tampered provider launches a small script, called a loader, that fetches malware suited to the victim's operating system. This includes an implant called FLATROOF. FLATROOF uses a Python-based stealer to collect sensitive data and then installs a backdoor called ROOFDECK. A backdoor is a hidden channel that gives the attackers full remote control of the machine.

This approach resembles other North Korean recruitment scams, such as Lazarus Group's Operation Dream Job and Famous Chollima's Contagious Interview. It works because developers routinely install tools and run code as part of their normal job.

How serious is it?

By value, this is the largest cryptocurrency theft on record. It is more than four times the roughly $1.46 billion taken from Bybit in February 2025, which was also blamed on North Korea. Elliptic said this single incident almost doubles the total the regime is believed to have stolen in crypto. For context, Chainalysis estimates North Korean hackers took about $2 billion in 2025 alone, a 50% increase on the year before.

The attack has already happened and the money is actively being laundered, so this is not a theoretical risk. The sources agree on who did it and on the general scale. They differ on the exact numbers: $6.3 billion versus $6.43 billion stolen, and about $3 billion versus $2.85 billion frozen. Peter Ward of the Sejong Institute said North Korea gives its hackers "near-total protection" and warned that the situation may get worse.

The breach also adds to Binance's history of compliance problems. In 2023 the company pleaded guilty to U.S. anti-money-laundering violations and paid a $4.3 billion fine. It was also ordered to wind down its EU operations in July after failing to obtain a licence there.

What to do now

For security teams and admins:

• Check your transaction-monitoring and compliance systems against the wallet addresses the FBI published.
• Only install Terraform providers and other developer plug-ins from verified sources. Review any new or unusual providers before they run in your environments.
• Treat engineers' laptops as high-value targets. Separate them from systems that can move funds or reach production secrets.
• Warn staff that unsolicited job offers asking them to run code, download tools or complete "technical tests" are a known North Korean tactic.
• Watch macOS, Linux and Windows endpoints alike, since this malware runs on all three.

For everyday users:

• Rely on Binance's official channels for updates on when withdrawals return to normal.
• Be suspicious of messages offering refunds, "compensation claims" or help recovering funds connected to the hack.
• If you work in tech or crypto, be wary of recruiters who quickly ask you to install software or run a project on your own machine.

What we still don't know

• How the engineer's laptop was first compromised, and whether a trojanized Terraform provider or a fake job lure was involved.
• What the "additional points of breach" were.
• Why the reported stolen and frozen totals differ between sources.
• How much of the roughly $3.3 billion in unfreezable assets can be traced or recovered.
• When all Binance withdrawals will be fully restored.

ITVedas analysis: This breach did not need a flaw in Binance's exchange software. It started with one engineer's laptop. That makes developer workstations and the tools developers install some of the most important defences in crypto security, and North Korea has shown it can exploit them at very large scale.