FBI Attributes $6.43 Billion Binance Crypto Heist to North Korean Hacking Group TraderTraitor

The U.S. Federal Bureau of Investigation (FBI) has attributed the theft of approximately $6.43 billion in cryptocurrency from Binance to TraderTraitor, a North Korea-linked hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899.

The FBI, working alongside the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), reported that the attackers were converting the stolen assets primarily into Ethereum (ETH). Investigators expect the funds to be moved through decentralized finance (DeFi) platforms and instant cryptocurrency swap services as part of efforts to obscure their origins.

Authorities have also published cryptocurrency wallet addresses associated with the suspected laundering activity to help identify and track the stolen funds.

Binance Resumes Withdrawals Following the Attack

Following the incident, Binance temporarily paused withdrawals while conducting security assessments and checking the readiness of affected services.

The exchange subsequently began restoring withdrawals in phases on November 1, 2026. Binance later confirmed that withdrawals had resumed across all 15 affected networks, while testing continued for remaining networks and assets.

According to Binance, between 06:00 and 15:30 UTC on November 1, the exchange processed approximately $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of around $3.64 billion.

The company said deposits remained available during the incident and that it had introduced precautionary measures to safeguard the platform before restoring withdrawal services.

Largest Cryptocurrency Theft on Record

The reported $6.43 billion theft would surpass the approximately $1.46 billion stolen from Bybit in February 2025, making it the largest cryptocurrency theft described in the report.

According to blockchain analysis firm Elliptic, the stolen assets were distributed across 11 blockchains, with approximately 82% associated with Ethereum and Bitcoin.

The incident also represents a significant escalation in cryptocurrency theft attributed to North Korean-linked threat actors. Elliptic estimates that these actors have stolen more than $6.5 billion in cryptocurrency over recent years.

Several major cryptocurrency organizations have reportedly frozen approximately $2.85 billion worth of the stolen assets on-chain. The companies and platforms involved include Tether, Circle, Ripple, Arbitrum, and Optimism.

Although freezing assets can prevent some funds from being moved, the attackers' reported efforts to convert and distribute the remaining cryptocurrency continue to complicate recovery efforts.

TraderTraitor's History of Cryptocurrency Theft

TraderTraitor is a North Korean threat group known for targeting cryptocurrency and Web3 organizations. Active since at least 2020, the group has used social engineering and malware-laced applications to compromise victims and steal digital assets.

The group has previously been linked to cryptocurrency thefts involving DMM Bitcoin, Bybit, KelpDAO, and Bitget.

Security researchers have also documented the group's evolving techniques, including the use of compromised development workflows, malicious software packages, and recruitment-themed social engineering campaigns.

These operations demonstrate how cryptocurrency theft increasingly combines technical compromise with carefully planned manipulation of employees, developers, and other individuals who have access to valuable systems.

Trojanized Terraform Providers Used to Deliver Malware

Recent reports from SentinelOne, Zscaler ThreatLabz, and Microsoft describe campaigns attributed to or associated with TraderTraitor that abuse trusted software development tools to distribute malware.

One documented technique involves trojanized Terraform providers. Terraform is widely used to manage infrastructure through configuration files and reusable providers. By disguising malicious code within a trusted development workflow, attackers can increase the likelihood that targets will execute harmful components.

In the reported campaign, a poisoned Terraform provider delivers a Bash loader that identifies the victim's operating system and downloads malware tailored to the environment.

The infection chain includes FLATROOF, a cross-platform implant associated with a Python-based information stealer, and the ROOFDECK backdoor, which can provide attackers with remote access to compromised systems.

The campaign targets macOS, Linux, and Windows environments, demonstrating how threat actors can use a shared development workflow to reach organizations operating across multiple platforms.

Abusing software dependencies and infrastructure-as-code tools also allows attackers to exploit the trust developers place in established repositories, providers, and automated deployment processes.

Fake Recruitment Campaigns Target Cybersecurity and AI Professionals

TraderTraitor has also expanded its use of recruitment-themed social engineering to target individuals working in cybersecurity, artificial intelligence, blockchain, and technology recruitment.

According to Microsoft, the group used tailored domains, social media profiles, and industry-specific knowledge to impersonate recruiters associated with a fictitious AI-powered blockchain intelligence company.

The attackers approached software engineers with seemingly legitimate job opportunities and attempted to arrange interviews with individuals who responded.

Microsoft reported that Jade Sleet conducted similar targeting activity through two additional front companies, supported by comparable infrastructure and relevant industry knowledge.

These campaigns resemble other North Korean-linked operations, including Lazarus Group's Operation Dream Job and Famous Chollima's Contagious Interview campaign. Such operations use career opportunities and professional networking as lures to persuade targets to engage with malicious content or execute attacker-supplied code.

The use of artificial intelligence can further improve these campaigns by helping attackers generate convincing messages, create fabricated professional identities, and tailor communications to specific industries.

Security Implications for Cryptocurrency and Development Teams

The Binance incident highlights the scale of financial damage that sophisticated threat actors can cause when they combine cryptocurrency theft with laundering techniques designed to make tracing and recovery more difficult.

The group's reported use of trojanized Terraform providers and recruitment-themed lures also demonstrates that cryptocurrency organizations are not the only potential targets. Developers, security professionals, and employees at blockchain and AI companies may be targeted as entry points into broader corporate environments.

Organizations can reduce exposure by reviewing third-party software dependencies, verifying provider sources, restricting permissions for infrastructure automation, and monitoring suspicious changes to development environments.

Security teams should also treat unsolicited recruitment opportunities with caution, particularly when interview processes require downloading unfamiliar applications, executing scripts, or installing software from unverified sources.

The FBI's attribution and publication of associated wallet addresses provide investigators and cryptocurrency platforms with additional information for tracking the stolen funds. However, the scale of the theft, the use of cross-chain transactions, and the attackers' continued evolution of their techniques present significant challenges for investigators and the wider cryptocurrency ecosystem.