FBI Attributes Record $6.43 Billion Crypto Theft to North Korea-Linked TraderTraitor
Summary
The FBI attributed a record $6.43 billion cryptocurrency theft to North Korea-linked TraderTraitor. Binance has begun phased withdrawal resumption, while $2.85 billion in assets have reportedly been frozen on-chain.
Key points
- The FBI attributed the theft of $6.43 billion in virtual assets to TraderTraitor, also tracked as Jade Sleet and other names.
- Authorities observed the actor converting stolen assets primarily into Ethereum and published wallet addresses reportedly used to launder them.
- Binance resumed the first phase of withdrawals after pausing them following the incident; deposits remain open, the company said.
- The theft spanned 11 blockchains; $2.85 billion of the assets have been frozen on-chain by Tether, Circle, Ripple, Arbitrum, and Optimism.
- Reports cited in the article say TraderTraitor has used trojanized Terraform providers to deliver a Bash loader, FLATROOF information-stealing malware, and the ROOFDECK backdoor.
- The group has also used job-themed social engineering, front companies, and AI-assisted lures targeting people in cybersecurity, AI, and blockchain.
Article Details
- Event Type
- Cryptocurrency theft officially attributed by the FBI to the North Korea-aligned TraderTraitor group.
- Impact
- More than $6 billion, reported as $6.43 billion, was stolen across 11 blockchains; 82% of the assets were on Ethereum and Bitcoin. Tether, Circle, Ripple, Arbitrum, and Optimism froze $2.85 billion on-chain. Binance said withdrawals had been paused and were being progressively restored; deposits remained open and unaffected. The FBI said it observed assets being converted primarily into Ethereum and expected further laundering through DeFi and instant-swap services.
MITRE ATT&CK
T1059.004 · Unix ShellThe poisoned provider delivers a Bash loader.T1105 · Ingress Tool TransferThe Bash loader selects and downloads malware tailored to the victim's operating system.T1195.001 · Compromise Software Dependencies and Development ToolsThe article describes trojanized Terraform providers used as a malware distribution vector.
Threat Actors
Malware
FLATROOFmalware tailored to the victim's operating system. This includes a cross-platform implant called FLATROOF, which siphons sensitive data from the victim using a Python-based information stealer before ultimatelyROOFDECKsensitive data from the victim using a Python-based information stealer before ultimately dropping the ROOFDECK backdoor to obtain complete remote control.
Products
ArbitrumOf the $6.43 billion stolen by TraderTraitor, $2.85 billion of the assets have been frozen on-chain by Tether, Circle, Ripple, Arbitrum, and Optimism.BinanceThe development comes as Binance said it has resumed phase one of withdrawals starting today between 6 and 9 a.m. UTC after they were paused in the wake of the incident.BitcoinThe haul eclipses the $1.46 billion plundered from Bybit in February 2025, making it the largest cryptocurrency theft in history. The funds were stolen across 11 blockchains, 82% of which were on Ethereum and Bitcoin.EthereumThe FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), said it observed the threat actor converting stolen assets primarily into Ethereum (ETH).OptimismOf the $6.43 billion stolen by TraderTraitor, $2.85 billion of the assets have been frozen on-chain by Tether, Circle, Ripple, Arbitrum, and Optimism.Terraformand Microsoft have revealed that TraderTraitor is continuing to hone its tradecraft, using trojanized Terraform providers as a malware distribution vector and leveraging front companies to conduct job-themed
Countries
Industries
Artificial intelligenceconvince victims to run malicious code. The social engineering phase is augmented by the use of artificial intelligence (AI) to craft convincing lures, create fake personas, and evade detection.Blockchain"This single incident almost doubles the total cryptoassets stolen by the regime," blockchain analysis firm Elliptic said. "Actors linked to North Korea, officially the Democratic People’s Republic of Korea (DPRK), areCryptocurrencyThe haul eclipses the $1.46 billion plundered from Bybit in February 2025, making it the largest cryptocurrency theft in history. The funds were stolen across 11 blockchains, 82% of which were on Ethereum and Bitcoin.Cybersecurityvector and leveraging front companies to conduct job-themed targeting against individuals involved in cybersecurity, AI, blockchain, and talent recruitment companies.talent recruitmentto conduct job-themed targeting against individuals involved in cybersecurity, AI, blockchain, and talent recruitment companies.Web3.0assigned to a North Korean group that has a history of orchestrating cryptocurrency thefts against the Web3.0 industry by tricking victims into downloading malware-laced applications. The cluster is known to be