FBI confirms it believes North Korean hackers targeted Binance in record-breaking cryptocurrency heist
follow us
Add us as a preferred source on Google
- FBI formally attributes $6.7 billion Binance cryptocurrency theft to North Korea’s TraderTraitor group
- Researchers say attackers are laundering stolen assets across multiple blockchains and DeFi services.
- The breach highlights ongoing threats from Lazarus-linked campaigns targeting crypto, DevOps, and software professionals.
The FBI has publicly accused a North Korean state-sponsored threat actor of being behind the recent attack on the Binance cryptocurrency exchange.
One of the largest cryptocurrency exchange platforms on the planet was forced to freeze deposits and withdrawals, before confirming that a threat actor stole around $6.7 billion in different cryptocurrencies.
Analysts rushed to investigate, with some claiming that a well-known North Korean state-sponsored group called TraderTraitor was behind the heist. TraderTraitor is apparently part of the Lazarus Group, a huge cybercriminal operation on the payroll of North Korea, supposedly tasked with stealing money to finance the country’s state apparatus and weapons program.
Latest videos ofTechnologyRadar
merchanttraitor
Now, the FBI has issued a new statement, officially naming TraderTraitor as the attackers.
“The Federal Bureau of Investigation (FBI) is releasing information reporting that the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion in virtual assets from the Binance cryptocurrency exchange on or about October 29, 2026. The FBI is referring to this North Korea-specific malicious cyber activity as ‘TraderTraitor,'” the announcement reads.
“The FBI, along with partners from the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected that these assets will then be further laundered by converting them using DeFi and instant exchange services while preparing them for later stages of laundering.”
Binance said one of its DevOps engineers had his laptop compromised, which “gave an attacker access to a service container, where he submitted unauthorized withdrawal transactions.” Some speculated that the engineer fell for a classic fake job scam, while others argued that it was a romance scam.
Meanwhile, Binance resumed operations and covered most of its losses.
Initial reports found that the attackers siphoned money from 10 different chains, including Bitcoin, Ethereum, Solana, XRP, Arbitrum, and others. For Ethereum, they even set up a smart contract that automatically cashed out any new money that flowed into the account. The positive side of the attack is that it was not user funds, but the exchange itself.
Cryptocurrency exchanges are required to have two separate wallets: one for their own funds and one for their clients’. Binance has a security fund called SAFU (Secure Asset Fund for Users), designed to protect user assets during extreme platform-level incidents, like this one.
DreamJob Operations and Contagious Interview
Obviously, North Korea has not commented on these accusations, but the cybersecurity community has already warned about the Lazarus Group attacking organizations in the West, sometimes tasked with stealing money and sometimes with cyber espionage and eavesdropping.
The group is divided into numerous subgroups, one of them is TraderTraitor and, among other things, the group runs two major scam campaigns: Operation DreamJob and Contagious Interview. Both are aimed at software developers, blockchain programmers and DevOps professionals, and the software development industry in general.
As part of these scams, attackers would create fake companies, fake employees, and fake job offers. They approached their targets on LinkedIn and offered them lucrative jobs, only to infect their computers with malware during interviews. In some cases, they would apply for vacant positions, posing as Chinese, Vietnamese or Thai nationals, and when they got the job, they would use the position to steal sensitive data and money.
North Korea is under heavy US sanctions and the country does not allow its companies to hire or do business with people and organizations in North Korea.
The FBI shared a long list of wallets that it believes contain the stolen funds and has asked THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics companies, and other virtual asset service providers to block transactions with or derived from these addresses.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment