The FBI has attributed the $6.3 billion Binance crypto heist to North Korean state-sponsored hackers known as TraderTraitor. The attack occurred around October 29, 2026, with approximately $6.36 billion stolen across ten blockchains in what the report describes as the largest cryptocurrency theft on record.
FBI Identifies Hundreds of Cryptocurrency Addresses
The agency’s attribution follows earlier findings from blockchain intelligence companies TRM Labs and Chainalysis. Both firms had already connected the theft to TraderTraitor. The report also associates the group with the names Lazarus Group, Jade Sleet and APT38.
According to the FBI, the attackers have primarily converted stolen assets into Ethereum. Investigators expect further laundering through decentralised finance platforms and instant cryptocurrency exchange services. Consequently, authorities have asked businesses handling virtual assets to block transactions involving associated addresses.
The FBI published 628 cryptocurrency addresses connected to the theft. These comprise 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address. Meanwhile, the US Secret Service and IRS Criminal Investigation joined the appeal to exchanges, blockchain operators and other service providers.
Compromised Laptop Enabled the Binance Crypto Heist
Binance traced the breach to a compromised laptop belonging to a DevOps engineer. According to the exchange, attackers used that access to reach a service container and submit unauthorised withdrawal transactions. Most of the stolen cryptocurrency left the platform within just 20 minutes.
The incident reflects a broader pattern of attacks against employees with access to cryptocurrency infrastructure. However, the supplied account does not establish how the attackers initially compromised the Binance engineer’s laptop. It therefore does not confirm whether recruitment lures or another social engineering technique enabled this particular breach.
North Korean hackers have previously approached developers and cryptocurrency workers with fraudulent job opportunities. In the campaign known as Operation DreamJob, attackers impersonate recruiters and persuade targets to install malware. These approaches can turn an employee’s computer into an entry point for a wider intrusion.
Earlier Attacks Targeted Developers and Trusted Contacts
Previous cryptocurrency thefts also involved compromised employee or developer devices. During the DMM Bitcoin attack, hackers posed as a LinkedIn recruiter and targeted an employee at wallet company Ginco. They persuaded the employee to run malicious Python code presented as a recruitment test.
Similarly, the Bybit theft involved a compromised Safe{Wallet} developer’s computer and manipulation of a legitimate transaction. Meanwhile, the reported Drift attack relied on months of relationship building, including meetings at industry conferences. Investigators believe a malicious repository or TestFlight application may have helped compromise devices in that operation.
Binance Says It Has Covered 95% of the Loss
Following the Binance crypto heist, the exchange said it had covered approximately 95% of the affected amount, up from 90%. The remaining portion involved less-liquid tokens that it continued purchasing through market and over-the-counter transactions. Binance also said it would absorb the financial losses without passing them to users.
In its November 1 update, the company announced plans to begin restoring withdrawals between 06:00 and 09:00 UTC that day. It said deposits remained unaffected and confirmed full backing for several major asset balances, including Bitcoin, Ethereum and USDT. However, the announcement described a planned reopening rather than confirming that withdrawals had already resumed.
0 responses to “Binance Crypto Heist: FBI Blames North Korean Hackers”