Overview
The FBI has confirmed that North Korean state-sponsored hackers tracked as TraderTraitor were behind the theft of about $6.36 billion in cryptocurrency from Binance on or about October 29, 2026, the largest crypto heist on record. The attribution follows earlier findings by blockchain analytics firms TRM Labs and Chainalysis. See our earlier coverage of the incident and its attribution for background; this article covers the FBI's formal statement.
Key Facts
| Item | Detail |
|---|---|
| Amount stolen | About $6.36 billion across ten blockchains |
| Speed | Most funds moved within about 20 minutes |
| Actor | TraderTraitor (also tracked as Lazarus Group, Jade Sleet, APT38) |
| Reported entry point | Compromised laptop of a DevOps engineer, used to reach a service container and submit unauthorized withdrawals |
| Laundering | Mainly converted to Ethereum; further laundering expected through DeFi platforms and instant swap services |
FBI Request to the Industry
The FBI, U.S. Secret Service, and IRS Criminal Investigation asked exchanges and other virtual asset providers to block transactions tied to the laundering addresses. The FBI published 628 addresses: 608 Ethereum, 19 Bitcoin, and one Solana.
The FBI stated that "North Korea was responsible for the theft of more than $6 billion USD in virtual assets."
Binance Response
- Withdrawals were scheduled to resume in phases, with the first phase on November 1, 2026 between 06:00 and 09:00 UTC. Deposits were unaffected.
- Binance says it has covered about 95% of the affected amount, up from 90%, and is buying the remaining less-liquid tokens.
- The company said the losses "will not be passed on to users."
Context: A Pattern of Large Thefts
The article ties TraderTraitor to a string of major thefts:
- Bitget: $387.5 million (September 2026)
- Drift: $280 million (April 2026)
- Bybit: $1.5 billion (February 2025)
- DMM Bitcoin: $308 million (May 2024)
The group also runs the long-running "Operation DreamJob" campaign, which uses fake job offers to deliver malware to employees at targeted firms.
Defensive Takeaways
- Harden engineer endpoints. The reported entry point was a developer/DevOps workstation. Treat these as tier-0 assets.
- Limit what service containers can sign or withdraw. Enforce multi-party approval and withdrawal limits independent of any single host.
- Train staff on fake recruiter lures. DreamJob-style outreach remains TraderTraitor's primary initial-access method.
- Ingest the FBI address list into compliance and transaction-screening tooling if you operate a virtual asset service.