The FBI has attributed the theft of more than $6 billion in cryptocurrency from Binance to TraderTraitor, a North Korean state-sponsored hacking group also known as the Lazarus Group, Jade Sleet, and APT38. The attack, which took place on or about October 29, 2026, is being described as the largest cryptocurrency heist in history, with approximately $6.36 billion stolen across 10 blockchains.
FBI attributes Binance theft to TraderTraitor
In a security alert issued Saturday, the FBI said TraderTraitor was responsible for the attack. The group has been linked to numerous cryptocurrency thefts and is tracked under several names by cybersecurity researchers.
“The Federal Bureau of Investigation (FBI) has released information advising that the Democratic People’s Republic of Korea (North Korea) is responsible for the theft of over $6 billion in virtual assets from the cryptocurrency exchange Binance on or about October 29, 2026,” the FBI said.
The official attribution follows findings from blockchain intelligence companies TRM Labs and Chaineries, which had already linked the incident to TraderTraitor.
Attack exploited access to Binance infrastructure
Binance previously said the breach was connected to a DevOps engineer’s laptop. The compromise gave the attackers access to a service container, allowing them to submit fraudulent withdrawal transactions.
The attackers moved most of the stolen funds within approximately 20 minutes. The FBI said TraderTraitor primarily converted the assets into Ethereum (ETH) and expects the cryptocurrency to be laundered further through decentralized finance (DeFi) platforms and instant crypto swap services.
The FBI, U.S. Secret Service, and IRS Criminal Investigation are asking cryptocurrency exchanges, blockchain operators, and other virtual asset service providers to block transactions associated with addresses used to launder the stolen funds.
The agency also published 628 cryptocurrency addresses linked to the theft. The list includes 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address.
TraderTraitor has repeatedly targeted crypto companies
TraderTraitor has a long history of targeting cryptocurrency companies and their employees. North Korean hackers were responsible for the $387.5 million Bitget theft in September 2026, two in April 2026. The group has also been linked to the $80 million Drift hack, the $1.5 billion Bybit heist in February 2025, and the $308 million DMM Bitcoin theft in May 2024.
One of the group’s established tactics is a long-running campaign known as “Operation DreamJob.” In these attacks, Lazarus hackers impersonate recruiters and offer fake jobs to software developers and cryptocurrency employees, attempting to trick them into installing malware.
Employee devices remain a key target
Both the DMM Bitcoin and Bybit attacks involved compromising computers belonging to employees or developers with access to cryptocurrency infrastructure.
During the DMM Bitcoin attack, a hacker posed as a LinkedIn recruiter and tricked an employee of crypto wallet company Ginco into running malicious Python code disguised as a pre-employment test.
The Bybit heist resulted from a compromise of computers used by Safe{Wallet} developers. The attackers gained access to the wallet platform and manipulated legitimate transaction requests from DMM employees, redirecting $1.5 billion in cryptocurrency to wallets they controlled.
More recently, the April 2026 Drift attack involved a six-month social engineering campaign. People posing as representatives of crypto trading companies met Drift contributors in person at multiple industry conferences.
The attackers are believed to have spent months building relationships and compromising employee devices through malicious code repositories and the TestFlight application.
Binance prepares to resume withdrawals
In a statement shared with BleepingComputer today, Binance said it is continuing to restore services and compensate for stolen assets. The exchange is preparing to resume the first phase of withdrawals between 06:00 and 09:00 UTC on November 1.
Binance said it now covers approximately 95% of the impact, up from 90% in its previous update. The remaining 5% consists of illiquid tokens, which the exchange continues to purchase through its marketplace and over-the-counter channels.
The exchange also said balances for BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed, while deposit services remain unaffected by the incident.
“Our commitment remains the same. The financial impact of stolen funds will be borne by Binance. These losses will not be passed on to our users,” Binance told BleepingComputer.
“Resuming withdrawals is a major milestone, but our efforts continue. We will continue to strengthen safety measures, complete the withdrawal process, and provide updates as we progress.”
Source: www.bleepingcomputer.com