FBI Blames North Korean TraderTraitor Group for $6.3bn Binance Theft

The FBI has formally blamed North Korean state-backed hackers for the theft of roughly $6.3 billion in cryptocurrency from Binance, according to BleepingComputer. The agency named the group TraderTraitor, which it also tracks as Lazarus Group, Jade Sleet and APT38. The theft is the biggest cryptocurrency heist ever recorded.

In a security alert issued on Saturday, the bureau said North Korea was behind the loss of more than $6 billion in virtual assets from the exchange, on or about October 29, 2026. The public attribution came after two blockchain intelligence companies, TRM Labs and Chainalysis, had already tied the raid to the same group.

Binance has said the intrusion began with an employee laptop. A DevOps engineer's machine was compromised, giving the attackers a way into a service container from which they pushed through withdrawal transactions that had not been authorised. Around $6.36 billion in crypto was taken across ten blockchains, and most of it moved within a 20 minute window.

Investigators say the stolen funds are being swapped largely into Ethereum. The FBI expects the group to push the assets further through decentralized finance platforms and instant swap services.

The FBI, the U.S. Secret Service and IRS Criminal Investigation have asked crypto trading venues, blockchain network operators and other firms that handle virtual assets to halt transactions tied to the laundering addresses. The bureau also released 628 wallet addresses linked to the incident, made up of 608 Ethereum addresses, 19 Bitcoin addresses and a single Solana address.

TraderTraitor has spent years going after crypto companies and their staff. North Korean attackers have been connected to a string of earlier thefts, including a $387.5 million loss at Bitget in September 2026, a $280 million Drift hack in April 2026, a $1.5 billion raid on Bybit in February 2025 and a $308 million theft from DMM Bitcoin in May 2024.

One recurring method is a campaign called Operation DreamJob, in which the hackers pose as recruiters and pitch fake roles to developers and crypto workers to get malware onto their machines. The DMM and Bybit incidents both involved compromised computers belonging to people with access to crypto infrastructure. In the DMM case, a LinkedIn recruiter impersonation led a Ginco employee to run malicious Python code disguised as a hiring test. The Bybit breach started on a Safe{Wallet} developer's machine, letting the attackers alter a legitimate transaction request and divert $1.5 billion to wallets they controlled. The April 2026 Drift attack involved six months of social engineering, with people posing as staff of a trading firm meeting Drift contributors at several industry conferences.