FBI Attributes Record $6.3B Binance Heist to North Korea
The FBI has officially confirmed that North Korean state-sponsored hackers were behind the historic $6.3 billion cryptocurrency theft from Binance, cementing it as the largest digital asset heist on record.
Radwan AbdulhadiEditor and technology writer
FBI Confirms North Korean Involvement in Record Heist
The Federal Bureau of Investigation has officially confirmed that North Korean state-sponsored hackers operating under the name TraderTraitor were responsible for the massive cryptocurrency theft targeting Binance. According to details shared in a security alert, the breach occurred on or about October 29, resulting in the theft of more than $6 billion in virtual assets, making it the largest cryptocurrency heist on record.
The hacking collective, which is also tracked by cybersecurity researchers under aliases such as Lazarus Group, Jade Sleet, and APT38, has a long history of targeting digital asset infrastructure. The official FBI attribution follows prior investigations by blockchain intelligence firms TRM Labs and Chainalysis that had already pointed toward the North Korean threat actors.
Breach Vector and Rapid Fund Transfers
Investigators and platform engineers have unpicked the initial entry method utilized during the massive intrusion. As previously reported, Binance traced the underlying breach to a compromised DevOps engineer's laptop, which subsequently granted the unauthorized actors access to a service container capable of submitting unverified withdrawal transactions.
Once inside the system, the attackers drained approximately $6.36 billion in cryptocurrency spanning ten separate blockchains. The overwhelming majority of these digital assets were transferred away from the platform in a remarkably tight window lasting just twenty minutes.
Laundering Tactics and Law Enforcement Response
Federal investigators tracking the stolen assets have observed the threat group systematically converting the pilfered funds primarily into Ethereum. Authorities anticipate that these assets will undergo further laundering through decentralized finance platforms and instant cryptocurrency swap services designed to obfuscate transaction trails.
In response to the unprecedented incident, the FBI, the U.S. Secret Service, and IRS Criminal Investigation have coordinated to ask virtual asset service providers, blockchain operators, and crypto exchanges to block transactions tied directly to the addresses used by the hackers. To aid these defense efforts, the agency released a comprehensive list of 628 crypto addresses associated with the theft, consisting of 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address.
A Broader Campaign Against Digital Asset Infrastructure
The TraderTraitor collective continues to present a severe threat to global financial technology systems through persistent campaigns targeting cryptocurrency companies and internal personnel. The group has been linked to numerous high-profile operations over recent years, including the $387.5 million Bitget theft and the $280 million Drift hack.
Additional major incidents tied to these actors feature the staggering $1.5 billion Bybit heist and the $308 million DMM Bitcoin theft. Attack methods frequently leverage sophisticated social engineering, such as fake recruiter personas deployed via Operation DreamJob to slip malicious payloads onto developer workstations.
Binance Recovery Efforts and Platform Status
Amid the ongoing investigations, Binance has focused heavily on financial recovery and system restoration to protect its user base. The organization confirmed that it has covered approximately 95% of the total impacted funds, up from 90% in earlier updates, while utilizing market and over-the-counter channels to acquire the remaining less-liquid tokens.
Furthermore, Binance emphasized that balances across core assets such as Bitcoin, Ethereum, Tether, and Binance Coin remain fully backed, with regular deposit services remaining untouched by the security breach. Company representatives reiterated a firm stance regarding financial accountability, noting that users will not absorb any losses resulting from the hack.
Sources
- BleepingComputerFBI links $6.3 billion Binance crypto heist to North Korean hackers
Continue chronologically
Related stories
FBI Flags Over 600 Addresses Tied to North Korea Binance Heist
The FBI flags over 600 crypto addresses linked to North Korean state-sponsored hackers following the record-breaking Binance breach.
Binance Hit by Record $6 Billion Crypto Heist
Blockchain intelligence firms attribute a record-breaking $6 billion theft from Binance wallets to North Korea's elite hacking unit, TraderTraitor.
Binance Details $6.3B Crypto Heist Linked to Fake Job Interview
Cryptocurrency exchange Binance details how North Korean hackers used social engineering, malware, and a fake job interview to pull off a massive heist.
Binance Resumes Withdrawals After $6.3 Billion Crypto Breach
Cryptocurrency exchange Binance has resumed withdrawals in a phased rollout following a massive $6.3 billion security breach, covering 95% of stolen assets.
