INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).
FBI Blames North Korea for $6 Billion Binance Crypto Theft
|
2026-11-02 11:45
CRITICAL
HIGH
STATE-SPONSORED & ESPIONAGE
FRAUD & CRYPTO THEFT
Executive Summary
AI-generated
The FBI has confirmed that North Korean state-sponsored hackers known as TraderTraitor were behind the $6.3 billion crypto-theft attack on Binance, making it the largest cryptocurrency heist on record. The FBI blames North Korea for stealing $6 billion from Binance and urges crypto firms to block transactions linked to the stolen funds. The US Federal Bureau of Investigation (FBI) has officially implicated North Korea as the backer of the recent hacking incident at the world's largest cryptocurrency exchange, Binance, which resulted in losses of approximately 6,400,000,000 dollars.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Operation Dream JobOperation Dream Job
Lazarus GroupLazarus GroupAPT38APT38
Target & Sectors
DPRK
DPRK
cryptocurrencycryptocurrency
Incident Timeline
September 2023
Channel News Asia reported that the connection between the Binance hack and the September 2023 Bitget hack has been confirmed.
Click on any entity below to view its context and source!
organisation
Channel News Asia
Channel News Asia reported that the connection between the Binance hack and the September 2023 Bitget hack has been confirmed.
May 2024
North Korean hackers, linked to previous crypto-theft attacks by TraderTraitor, targeted DMM Bitcoin in May 2024.
Click on any entity below to view its context and source!
source_region
DPRK
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
financial
$308 million
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
financial
$387.5 million
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
financial
$1.5 Bybit hack
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
organisation
Drift
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
financial
$280 Drift hack
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
February 2025
North Korean hackers, linked to numerous crypto-theft attacks, targeted Binance for a $6 billion cryptocurrency theft.
Click on any entity below to view its context and source!
financial
$1.5 Bybit hack
That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
financial
$1,460,000,000 times
This is more than four times the estimated $1,460,000,000 in damages from the February 2025 Bybit hack.
"
The haul eclipses the $1.46 billion plundered from Bybit in February 2025, making it the largest cryptocurrency theft in history.
general_metric
1.5 Bybit hack
That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025.
source_region
DPRK
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
financial
$308 million
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
financial
$387.5 million
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
organisation
Drift
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
financial
$280 Drift hack
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
organisation
Bybit
"
The haul eclipses the $1.46 billion plundered from Bybit in February 2025, making it the largest cryptocurrency theft in history.
April 2026
TraderTraitor, linked to North Korea, conducted a six-month social engineering operation targeting Drift contributors at multiple industry conferences.
Click on any entity below to view its context and source!
source_region
DPRK
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
financial
$308 million
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
financial
$387.5 million
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
financial
$1.5 Bybit hack
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
organisation
Drift
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
financial
$280 Drift hack
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
tactic
Social Engineering
More recently, the April 2026 Drift attack involved a six-month social engineering operation in which individuals posing as representatives of a cryptocurrency trading firm met Drift contributors in person at multiple industry conferences.
September 2026
TraderTraitor, linked to North Korean hackers, targeted Bitget in September 2026.
Click on any entity below to view its context and source!
source_region
DPRK
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
financial
$308 million
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
financial
$387.5 million
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
financial
$1.5 Bybit hack
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
organisation
Drift
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
financial
$280 Drift hack
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
September 24
North Korea-linked cyberactors launched a successful attack on Bithumb, resulting in the theft of approximately 387,000,000 dollars' worth of virtual assets.
Click on any entity below to view its context and source!
source_region
DPRK
Bithumb has been hit by a North Korean-linked cyberattack on September 24, resulting in the loss of approximately 387,000,000 dollars' worth of virtual assets.
financial
387,000,000 dollars
Bithumb has been hit by a North Korean-linked cyberattack on September 24, resulting in the loss of approximately 387,000,000 dollars' worth of virtual assets.
October 1
Threat actors moved the stolen $6 billion Binance crypto funds to multiple cryptocurrencies, including Ethereum, Ripple (XRP), Zcash, and Tron, within 3 hours of the theft.
Click on any entity below to view its context and source!
organisation
Ethereum, Ripple (XRP
According to Channel News Asia, which released the analysis on October 1, the attackers moved the funds to Ethereum, Ripple (XRP), Zcash, and Tron within 3 hours of the theft.
organisation
Tron
According to Channel News Asia, which released the analysis on October 1, the attackers moved the funds to Ethereum, Ripple (XRP), Zcash, and Tron within 3 hours of the theft.
general_metric
3 hours
According to Channel News Asia, which released the analysis on October 1, the attackers moved the funds to Ethereum, Ripple (XRP), Zcash, and Tron within 3 hours of the theft.
October 29
TraderTraitor, a North Korean hacking operation linked to Lazarus, used unusual financial transactions on multiple blockchain hot wallets at Binance to steal approximately $6.36 billion on October 29.
Click on any entity below to view its context and source!
source_region
DPRK
In an
alert published Saturday
, the agency attributed the October 29 attack to TraderTraitor, a North Korean hacking operation linked to Lazarus, which has made a lucrative career out of relieving crypto exchanges of their digital assets.
organisation
TraderTraitor
In an
alert published Saturday
, the agency attributed the October 29 attack to TraderTraitor, a North Korean hacking operation linked to Lazarus, which has made a lucrative career out of relieving crypto exchanges of their digital assets.
financial
$6.36 billion
TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC.
general_metric
20 minutes
TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC.
organisation
TRM
TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC.
organisation
UTC
TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC.
about October 29, 2026
The Federal Bureau of Investigation (FBI) has named North Korea as the party behind the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance on or about October 29, 2026.
Click on any entity below to view its context and source!
target_region
DPRK
The FBI has named North Korea as the party behind the
theft of more than $6 billion
in virtual assets from the crypto exchange Binance, on or about October 29, 2026.
“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.
"The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,"
the FBI said
.
attribution
FBI
The FBI has named North Korea as the party behind the
theft of more than $6 billion
in virtual assets from the crypto exchange Binance, on or about October 29, 2026.
"The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,"
the FBI said
.
financial
$6 Binance Crypto Theft
“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.
"The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,"
the FBI said
.
attribution
The Federal Bureau of Investigation (FBI
“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.
"The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,"
the FBI said
.
organisation
the Democratic People’s Republic of Korea
“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.
organisation
the Democratic People's Republic of Korea
"The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,"
the FBI said
.
October 31
The FBI attributed the $6 billion Binance crypto theft to North Korea's 'TraderTraitor' operation.
Click on any entity below to view its context and source!
source_region
DPRK
The FBI announced on October 31 that the hacking incident at Binance, which resulted in losses of over 6,000,000,000 dollars, was linked to North Korea's cyber-attacks, specifically the 'TraderTraitor' operation.
attribution
FBI
The FBI announced on October 31 that the hacking incident at Binance, which resulted in losses of over 6,000,000,000 dollars, was linked to North Korea's cyber-attacks, specifically the 'TraderTraitor' operation.
financial
$6 Binance Crypto Theft
The FBI announced on October 31 that the hacking incident at Binance, which resulted in losses of over 6,000,000,000 dollars, was linked to North Korea's cyber-attacks, specifically the 'TraderTraitor' operation.
source_region
Korea, Democratic People's Republic of
The FBI announced on October 31 that the hacking incident at Binance, which resulted in losses of over 6,000,000,000 dollars, was linked to North Korea's cyber-attacks, specifically the 'TraderTraitor' operation.
November 01, 2026
The FBI attributed the $6 billion Binance crypto theft to North Korea.
Click on any entity below to view its context and source!
target_region
DPRK
FBI Blames North Korea for $6 Billion Binance Crypto Theft
Pierluigi Paganini
November 01, 2026
attribution
FBI
FBI Blames North Korea for $6 Billion Binance Crypto Theft
Pierluigi Paganini
November 01, 2026
financial
$6 Binance Crypto Theft
FBI Blames North Korea for $6 Billion Binance Crypto Theft
Pierluigi Paganini
November 01, 2026
2026/11/01
Binance resumed phase one of withdrawals starting today between 6 and 9 a.m. UTC after they were paused following the reported $6 billion crypto theft attributed to North Korea.
Click on any entity below to view its context and source!
organisation
UTC
In a statement shared with BleepingComputer today, Binance said it was preparing to resume the first phase of withdrawals on November 1 between 06:00 and 09:00 UTC, as it continues working to restore services and cover the stolen assets.
The development comes as Binance
said
it has resumed phase one of withdrawals starting today between 6 and 9 a.m. UTC after they were paused in the wake of the incident.
organisation
BleepingComputer
In a statement shared with BleepingComputer today, Binance said it was preparing to resume the first phase of withdrawals on November 1 between 06:00 and 09:00 UTC, as it continues working to restore services and cover the stolen assets.
2026/11/02
North Korea-linked hackers, tracked as TraderTraitor and also known as the Lazarus Group, APT38, used trojanized Terraform providers to deliver cross-platform malware across macOS, Linux, and Windows systems, gaining persistent access before stealing approximately $6.36 billion in cryptocurrency from Binance.
Click on any entity below to view its context and source!
organisation
Ethereum
According to the FBI, the hackers have started swapping their loot for Ethereum, with investigators expecting them to move the funds through decentralized finance (DeFi) platforms and instant swap services to make the money harder to trace.
“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH).
The FBI warned that the attackers primarily converted the stolen assets into Ethereum (ETH), and there is a high likelihood that the attackers will expand their money laundering operations using DeFi platforms and immediate exchange services in the future.
threat_actor
Lazarus Group
security
FBI pins $6.3B Binance crypto heist on North Korean hackers
Exchange scrambles to replace stolen funds as customers withdraw billions and hackers get busy laundering their haul
The FBI has blamed North Korean hackers for the record-breaking $6.3 billion theft from cryptocurrency exchange Binance, pointing the finger at the notorious Lazar…
The FBI specifically blames the North Korea-linked APT “
TraderTraitor
,” also tracked as
Lazarus Group
and
APT38
.
In a security alert published Saturday, the agency attributed the attack to TraderTraitor, a North Korean hacking group also tracked as Lazarus Group, Jade Sleet, and APT38, linked to numerous cryptocurrency thefts.
financial
$6.3 billion
security
FBI pins $6.3B Binance crypto heist on North Korean hackers
Exchange scrambles to replace stolen funds as customers withdraw billions and hackers get busy laundering their haul
The FBI has blamed North Korean hackers for the record-breaking $6.3 billion theft from cryptocurrency exchange Binance, pointing the finger at the notorious Lazar…
FBI links $6.3 billion Binance crypto heist to North Korean hackers.
The FBI has confirmed that North Korean state-sponsored hackers known as TraderTraitor were behind the $6.3 billion crypto-theft attack on Binance, making it the largest cryptocurrency heist on record.
organisation
DeFi
According to the FBI, the hackers have started swapping their loot for Ethereum, with investigators expecting them to move the funds through decentralized finance (DeFi) platforms and instant swap services to make the money harder to trace.
The FBI warned that the attackers primarily converted the stolen assets into Ethereum (ETH), and there is a high likelihood that the attackers will expand their money laundering operations using DeFi platforms and immediate exchange services in the future.
The FBI says it has observed TraderTraitor converting stolen assets primarily into Ethereum (ETH), which it expects will be further laundered through decentralized finance (DeFi) platforms and instant cryptocurrency swap services.
organisation
ETH
“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH).
The FBI warned that the attackers primarily converted the stolen assets into Ethereum (ETH), and there is a high likelihood that the attackers will expand their money laundering operations using DeFi platforms and immediate exchange services in the future.
The FBI says it has observed TraderTraitor converting stolen assets primarily into Ethereum (ETH), which it expects will be further laundered through decentralized finance (DeFi) platforms and instant cryptocurrency swap services.
organisation
Binance
The US Federal Bureau of Investigation (FBI) has officially implicated North Korea as the backer of the recent hacking incident at the world's largest cryptocurrency exchange, Binance, which resulted in losses of approximately 6,400,000,000 dollars.
Binance has confirmed a security incident and suspended withdrawals on several networks.”
Binance also said that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC balances are fully backed, and that deposit services remain unaffected by the incident.
organisation
TraderTraitor
The FBI has confirmed that North Korean state-sponsored hackers known as TraderTraitor were behind the $6.3 billion crypto-theft attack on Binance, making it the largest cryptocurrency heist on record.
“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH).
"
Of the $6.43 billion stolen by TraderTraitor, $2.85 billion of the assets have been frozen on-chain by Tether, Circle, Ripple, Arbitrum, and Optimism.
organisation
DevOps
According to the exchange
, the trouble started with a compromised DevOps engineer's laptop, which gave the intruders access to a service container and allowed them to authorize withdrawals they had no business making.
The entry point is believed to be related to the development and operation (DevOps) engineer at Binance who used a notebook to carry out the attack.
As
previously reported
, Binance linked the breach to a compromised DevOps engineer's laptop, which allowed the attackers to access a service container and submit unauthorized withdrawal transactions.
financial
$6.36 billion
Blockchain intelligence firms
TRM Labs
and
Elliptic
had linked the theft to North Korea, with TRM reporting that most of the $6.36 billion haul disappeared in about 20 minutes.
The attackers stole approximately $6.36 billion in cryptocurrency across ten blockchains, with most of the funds transferred in just 20 minutes.
financial
$6 Binance Crypto Theft
FBI Blames North Korea for $6 Billion Binance Crypto Theft.
The FBI blames North Korea for stealing $6 billion from Binance and urges crypto firms to block transactions linked to the stolen funds.
financial
$6,400,000,000 $ worth
The FBI has officially linked North Korea to a cyber attack behind a hack worth $6,400,000,000 on the cryptocurrency exchange Binance.
The US Federal Bureau of Investigation (FBI) has officially implicated North Korea as the backer of the recent hacking incident at the world's largest cryptocurrency exchange, Binance, which resulted in losses of approximately 6,400,000,000 dollars.
financial
$6.43 billion
FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist.
Elliptic, which puts the total closer to $6.43 billion, says it has verified that $2.85 billion of the stolen assets have been frozen or seized.
organisation
DMM Bitcoin
The North Korean crew has previously been linked to a string of cryptocurrency thefts, including the $308 million attack on
Japan's DMM Bitcoin exchange in 2024
.
The FBI has identified the same organization as the behind-the-scenes force behind the 308,000,000 dollars' worth of virtual assets stolen from DMM Bitcoin in Japan in 2024.
financial
$308 million
The North Korean crew has previously been linked to a string of cryptocurrency thefts, including the $308 million attack on
Japan's DMM Bitcoin exchange in 2024
.
The FBI has identified the same organization as the behind-the-scenes force behind the 308,000,000 dollars' worth of virtual assets stolen from DMM Bitcoin in Japan in 2024.
threat_actor
APT38
The FBI specifically blames the North Korea-linked APT “
TraderTraitor
,” also tracked as
Lazarus Group
and
APT38
.
In a security alert published Saturday, the agency attributed the attack to TraderTraitor, a North Korean hacking group also tracked as Lazarus Group, Jade Sleet, and APT38, linked to numerous cryptocurrency thefts.
organisation
USSS
“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH).
The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), said it observed the threat actor converting stolen assets primarily into Ethereum (ETH).
organisation
IRS-CI
“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH).
The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), said it observed the threat actor converting stolen assets primarily into Ethereum (ETH).
organisation
the U.S. Secret Service
The FBI, along with the U.S. Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), has spotted TraderTraitor actors turning the stolen assets mostly into Ethereum (ETH).
The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), said it observed the threat actor converting stolen assets primarily into Ethereum (ETH).
organisation
IRS Criminal Investigation
The FBI, along with the U.S. Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), has spotted TraderTraitor actors turning the stolen assets mostly into Ethereum (ETH).
The FBI, U.S. Secret Service, and IRS Criminal Investigation are now asking cryptocurrency exchanges, blockchain operators, and other virtual asset service providers to block transactions linked to addresses the hackers used to launder stolen funds.
financial
$2.85 billion
"
Of the $6.43 billion stolen by TraderTraitor, $2.85 billion of the assets have been frozen on-chain by Tether, Circle, Ripple, Arbitrum, and Optimism.
Elliptic, which puts the total closer to $6.43 billion, says it has verified that $2.85 billion of the stolen assets have been frozen or seized.
organisation
BTC
Binance also said that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC balances are fully backed, and that deposit services remain unaffected by the incident.
It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach.
financial
$387.5 million
As we reported here on
Friday
, crypto exchange Bitget has now confirmed that the cyberattack where hackers drained
$387.5 million
worth of digital assets from the exchange’s wallets also has all the hallmarks of a North Korean operation.
organisation
SecurityAffairs
Follow me on Twitter:
@securityaffairs
and
Facebook
and
Mastodon
Pierluigi Paganini
(
SecurityAffairs
– hacking, Binance)
facebook
linkedin
twitter
Binance
Cybercrime
FBI
Hacking
hacking news
information security news
IT Information Security
North Korea
Pierluigi Paganini
Security Affairs
Security News
TraderTraitor
organisation
IT Information Security
Follow me on Twitter:
@securityaffairs
and
Facebook
and
Mastodon
Pierluigi Paganini
(
SecurityAffairs
– hacking, Binance)
facebook
linkedin
twitter
Binance
Cybercrime
FBI
Hacking
hacking news
information security news
IT Information Security
North Korea
Pierluigi Paganini
Security Affairs
Security News
TraderTraitor
organisation
Security Affairs
Follow me on Twitter:
@securityaffairs
and
Facebook
and
Mastodon
Pierluigi Paganini
(
SecurityAffairs
– hacking, Binance)
facebook
linkedin
twitter
Binance
Cybercrime
FBI
Hacking
hacking news
information security news
IT Information Security
North Korea
Pierluigi Paganini
Security Affairs
Security News
TraderTraitor
organisation
Security News
Follow me on Twitter:
@securityaffairs
and
Facebook
and
Mastodon
Pierluigi Paganini
(
SecurityAffairs
– hacking, Binance)
facebook
linkedin
twitter
Binance
Cybercrime
FBI
Hacking
hacking news
information security news
IT Information Security
North Korea
Pierluigi Paganini
Security Affairs
Security News
TraderTraitor
organisation
Channel NewsAsia
Channel NewsAsia reported that this year's virtual asset hacking losses account for 89% of North Korea's involvement..
organisation
PUKCHONG
The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets to
TraderTraitor
, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899.
organisation
Slow Pisces
The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets to
TraderTraitor
, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899.
organisation
UNC4899
The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets to
TraderTraitor
, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899.
Tactical Metrics
Metrics
financial
$6.4B
Financial Impact
Click for context!
Blockchain intelligence firms
TRM Labs
and
Elliptic
had linked the theft to North Korea, with TRM reporting that most of the $6.36 billion haul disappeared in about 20 minutes.
TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC.
The attackers stole approximately $6.36 billion in cryptocurrency across ten blockchains, with most of the funds transferred in just 20 minutes.
Metrics
financial
$308M
Stolen Funds
The North Korean crew has previously been linked to a string of cryptocurrency thefts, including the $308 million attack on
Japan's DMM Bitcoin exchange in 2024
.
The FBI has identified the same organization as the behind-the-scenes force behind the 308,000,000 dollars' worth of virtual assets stolen from DMM Bitcoin in Japan in 2024.
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
Metrics
financial
$6.3B
Stolen Funds
security
FBI pins $6.3B Binance crypto heist on North Korean hackers
Exchange scrambles to replace stolen funds as customers withdraw billions and hackers get busy laundering their haul
The FBI has blamed North Korean hackers for the record-breaking $6.3 billion theft from cryptocurrency exchange Binance, pointing the finger at the notorious Lazar…
The FBI's attribution comes days after Binance admitted that hackers had made off with roughly $6.3 billion in cryptocurrency.
FBI links $6.3 billion Binance crypto heist to North Korean hackers.
The FBI has confirmed that North Korean state-sponsored hackers known as TraderTraitor were behind the $6.3 billion crypto-theft attack on Binance, making it the largest cryptocurrency heist on record.
Metrics
financial
$388M
Stolen Funds
As we reported here on
Friday
, crypto exchange Bitget has now confirmed that the cyberattack where hackers drained
$387.5 million
worth of digital assets from the exchange’s wallets also has all the hallmarks of a North Korean operation.
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
Metrics
financial
$566M
Financial Impact
Back in 2022, attackers
exploited its BNB blockchain bridge
and made off with roughly $566 million in tokens.
Metrics
financial
$6.4B
Financial Impact
Elliptic, which puts the total closer to $6.43 billion, says it has verified that $2.85 billion of the stolen assets have been frozen or seized.
FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist.
Metrics
financial
$2.9B
Stolen Funds
Elliptic, which puts the total closer to $6.43 billion, says it has verified that $2.85 billion of the stolen assets have been frozen or seized.
"
Of the $6.43 billion stolen by TraderTraitor, $2.85 billion of the assets have been frozen on-chain by Tether, Circle, Ripple, Arbitrum, and Optimism.
Metrics
financial
$3.6B
Financial Impact
Binance recorded approximately $3.64 billion in net outflows after withdrawals resumed, although the company said this represented only around 2.1 percent of its reported assets.
Metrics
financial
6,000,000,000
Binance Crypto Theft
FBI Blames North Korea for $6 Billion Binance Crypto Theft.
FBI Blames North Korea for $6 Billion Binance Crypto Theft
Pierluigi Paganini
November 01, 2026
The FBI blames North Korea for stealing $6 billion from Binance and urges crypto firms to block transactions linked to the stolen funds.
“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.
The FBI announced on October 31 that the hacking incident at Binance, which resulted in losses of over 6,000,000,000 dollars, was linked to North Korea's cyber-attacks, specifically the 'TraderTraitor' operation.
"The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,"
the FBI said
.
Metrics
financial
1,500,000,000
Bybit Hack
That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
The Bybit heist also stemmed from a compromised Safe{Wallet} developer's computer, which let hackers access the wallet platform and manipulate a legitimate transaction request by a DMM employee, redirecting $1.5 billion in cryptocurrency to wallets they controlled.
Metrics
financial
2,670,000,000
Financial Impact / Stolen Funds
Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for roughly $2.7 billion in all.
Metrics
financial
2,400,000,000
Btc
It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach.
Metrics
financial
1,790,000,000
Financial Impact / Stolen Funds
The early freeze numbers were messy too, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports.
Metrics
financial
6,400,000,000
$ Worth
The FBI has officially linked North Korea to a cyber attack behind a hack worth $6,400,000,000 on the cryptocurrency exchange Binance.
The US Federal Bureau of Investigation (FBI) has officially implicated North Korea as the backer of the recent hacking incident at the world's largest cryptocurrency exchange, Binance, which resulted in losses of approximately 6,400,000,000 dollars.
Metrics
financial
13,200,000,000
Dollars
North Korea-linked hacking losses have increased by 3.7 times over the past 6 years, reaching approximately 13,200,000,000 dollars.
Metrics
financial
387,000,000
Dollars
Bithumb has been hit by a North Korean-linked cyberattack on September 24, resulting in the loss of approximately 387,000,000 dollars' worth of virtual assets.
Metrics
financial
50,650,000
Financial Impact / Stolen Funds
The loss in 2021 was $50,650,000, while in 2026 it has risen to $185,650,000, a 3.7-fold increase.
Metrics
financial
1,460,000,000
Financial Impact / Stolen Funds
This is more than four times the estimated $1,460,000,000 in damages from the February 2025 Bybit hack.
"
The haul eclipses the $1.46 billion plundered from Bybit in February 2025, making it the largest cryptocurrency theft in history.
Metrics
financial
280,000,000
Drift Hack
TraderTraitor has a long history of targeting cryptocurrency companies and their employees, with North Korean hackers linked to numerous crypto-theft attacks, including the
$387.5 million Bitget theft
in September 2026, the
$280 million Drift hack
in April 2026,
$1.5 billion Bybit heist
in February 2025, and the
$308 million DMM Bitcoin theft
in May 2024.
Metrics
infrastructure
Microsoft 365
Affected Product
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Metrics
financial
6,500,000,000
Financial Impact / Stolen Funds
"Actors linked to North Korea, officially the Democratic People’s Republic of Korea (DPRK), are believed to have stolen over $6.5 billion in cryptoassets in recent years.
Metrics
infrastructure
Macos
Affected Product
The activity once again demonstrates how North Korean threat actors continue to abuse trusted developer workflows through trojanized Terraform providers to deliver cross-platform malware across macOS, Linux, and Windows systems, and gain persistent access.
Metrics
infrastructure
Linux
Affected Product
The activity once again demonstrates how North Korean threat actors continue to abuse trusted developer workflows through trojanized Terraform providers to deliver cross-platform malware across macOS, Linux, and Windows systems, and gain persistent access.
Metrics
infrastructure
Windows
Affected Product
The activity once again demonstrates how North Korean threat actors continue to abuse trusted developer workflows through trojanized Terraform providers to deliver cross-platform malware across macOS, Linux, and Windows systems, and gain persistent access.
Intelligence Sources
The Hacker News
2026-11-01
BleepingComputer
2026-11-01
FBI links $6.3 billion Binance crypto heist to North Korean hackers
BleepingComputer
Dailysecu
2026-11-01
Security Affairs
2026-11-01
FBI Blames North Korea for $6 Billion Binance Crypto Theft
Security Affairs
The Register - CSO
2026-11-02
FBI pins $6.3B Binance crypto heist on North Korean hackers
The Register - CSO
Unpublish from Social Media?
Are you sure you want to delete this podcast video from all synchronized social networks (YouTube, Facebook, Threads)?
Important:
Due to Meta API restrictions, Instagram Reels cannot be deleted automatically via API by third-party apps.
View Profile to Delete Manually
View Profile to Delete Manually
Tactical Intelligence
Report Intelligence Issue
Podcast Options
Generate
Incident Version History
CURRENT VERSION
Last Updated: 2026-11-03T23:42
Comprehensive Tactical Telemetry
Highly Correlated Entities
59x
organisation
Identified Entity
DMM Bitcoin
entity
22x
timeline
Temporal Reference
2024
date
6x
general metric
%
89
%
5x
attribution
Attributing Entity
FBI
authority
5x
financial
Financial Impact / Stolen Funds
2,670,000,000
financial
4x
financial
Financial Impact
$6.4B
4x
financial
Stolen Funds
$308M
4x
infrastructure
Affected Product
Microsoft 365
software
3x
threat actor
APT Group
Lazarus Group
actor
3x
tactic
Cyber Operation Type
Phishing
tactic
2x
target region
Target Country
Japan
country
2x
general metric
Percent
95
percent
2x
general metric
Eth
8,426
eth
2x
financial
Dollars
13,200,000,000
dollars
Contextual Telemetry
Context Block
22 METRICS
target region
Target Region
DPRK
region
general metric
Minutes
20
minutes
source region
Origin Region
DPRK
region
financial
Binance Crypto Theft
6,000,000,000
binance crypto theft
source region
Origin Country
Korea, Democratic People's Republic of
country
financial
Bybit Hack
1,500,000,000
bybit hack
general metric
Usd
6,360,000,000
usd
general metric
Bybit Hack
1,500,000,000
bybit hack
general metric
Arb
74,600,000
arb
general metric
Btc
18,270
btc
financial
Btc
2,400,000,000
btc
financial
$ Worth
6,400,000,000
$ worth
general metric
Fold Increase
4
fold increase
general metric
Hours
3
hours
tactic
MITRE ATT&CK Technique
T1059.006 - Python
technique
campaign
Campaign
Operation Dream Job
operation
financial
Drift Hack
280,000,000
drift hack
general metric
Cryptocurrency Addresses
628
cryptocurrency addresses
general metric
Ethereum Addresses
608
ethereum addresses
general metric
Bitcoin Addresses
19
bitcoin addresses
general metric
Remaining %
5
remaining %
general metric
Blockchains
11
blockchains
Click on any entity below to view its context in the main text!
Selective Unpublish
Select the networks you want to remove this post from. The system will try to delete the real post through the API and clean the database so you can publish it again.
By navigating this website, you accept the use of strictly necessary technical cookies for session security and basic platform functionality. We do not use tracking or advertising cookies. Read our Privacy Policy.
Generating report…
0s