FBI Attributes $6.3 Billion Binance Heist to North Korean Hackers
Summary
The FBI attributed the October 29 theft of about $6.36 billion from Binance to North Korean group TraderTraitor. Binance linked the breach to a compromised DevOps engineer’s laptop and says it has covered about 95% of the affected amount.
Key points
- The FBI attributed the theft of more than $6 billion from Binance to North Korean state-sponsored group TraderTraitor.
- Binance linked the breach to a compromised DevOps engineer’s laptop, which allegedly enabled access to a service container and unauthorized withdrawal transactions.
- About $6.36 billion in cryptocurrency was stolen across ten blockchains, with most funds transferred within 20 minutes.
- The FBI said it observed TraderTraitor converting stolen assets primarily into Ethereum and urged virtual-asset service providers to block transactions linked to the theft.
- The FBI published 628 associated cryptocurrency addresses: 608 Ethereum, 19 Bitcoin, and one Solana address.
- Binance said it planned to resume the first phase of withdrawals on November 1 and had covered about 95% of the impacted amount; it said deposits remained unaffected.
Article Details
- Victim Organization
- Binance
- Incident Type
- Cryptocurrency theft through a compromised DevOps engineer's laptop, which enabled access to a service container and unauthorized withdrawal transactions.
- Incident Date
- 2026-10-29
- Disclosure Date
- 2026-10-31
- Affected Data Size
- Approximately $6.36 billion in cryptocurrency stolen across ten blockchains.
- Operational Impact
- Binance said it was working to restore services and planned to resume the first phase of withdrawals on November 1. Deposit services remained unaffected. Binance said it had covered approximately 95% of the impacted amount.
- Claim Status
- confirmed
Threat Actors
APT38The article says TraderTraitor is also tracked as APT38; the FBI attributed the Binance cryptocurrency theft to TraderTraitor.Jade SleetThe FBI attributed the Binance cryptocurrency theft to TraderTraitor and identified it as a North Korean state-sponsored hacking group.Lazarus GroupThe article says TraderTraitor is also tracked as Lazarus Group; the FBI attributed the Binance cryptocurrency theft to TraderTraitor.