- The FBI formally attributes $6.7 billion Binance cryptocurrency theft to North Korea’s TraderTraitor group
- Investigators say the attackers are laundering stolen assets across multiple blockchains and DeFi services
- The breach highlights ongoing threats from Lazarus-linked campaigns targeting crypto, DevOps, and software professionals
The FBI has publicly accused a North Korean state-sponsored threat actor of being behind the recent attack on cryptocurrency exchange Binance.
One of the largest cryptocurrency exchange platforms on the planet was forced to freeze deposits and withdrawals, before confirming a threat actor stole around $6.7 billion worth of different cryptocurrencies.
Analysts were quick to investigate, with some claiming a known North Korean state-sponsored group called TraderTraitor was behind the heist. TraderTraitor is apparently part of Lazarus Group – a huge cybercriminal operation on North Korea’s payroll, allegedly tasked with stealing money to fund the country’s state apparatus and weapons program.
TraderTraitor
Now, the FBI has issued a new statement, official naming TraderTraitor as the attackers.
“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as ‘TraderTraitor’.,” the announcement reads.
“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.”
Binance said one of its DevOps engineers had their laptop compromised which “gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.” Some speculated the engineer fell to a classic fake job scam, while others argued it was a romance scam.
In the meantime, Binance resumed operations and has covered most of its losses.
Initial reports found that the attackers siphoned out money from 10 different chains, including Bitcoin, Ethereum, Solana, XRP, Arbitrum, and others. For Ethereum, they even set up a smart contract that automatically withdrew any new money that was flowing into the account. The silver lining in the attack is that these were not user funds, but rather those of the exchange itself.
Cryptocurrency exchanges are obliged to have two separate wallets – one for their own funds, and one for those of their customers. Binance has a security fund called SAFU (Secure Asset Fund for Users), designed to protect user assets during extreme platform-level incidents, such as this one.
Operations DreamJob and Contagious Interview
Obviously, North Korea has not commented on these allegations, but the cybersecurity community has logn warned about Lazarus Group targeting organizations in the West, sometimes tasked with stealing money, and sometimes with cyber-espionage and eavesdropping.
The group is split into numerous sub-groups, one of them being TraderTraitor, and among other things, the group runs two major scam campaigns: Operation DreamJob, and Contagious Interview. Both are aimed at software developers, blockchain programmers, and DevOps professionals, and the wider software development industry.
As part of these scams, the attackers would create fake companies, fake employees, and fake job offers. They would reach out to their targets on LinkedIn and offer lucrative job positions, only to infect their computers with malware during the interviews. In some cases, they would apply for open positions, impersonating Chinese, Vietnamese, or Thai nationals and would, when they get the job, use the position to steal sensitive data and money.
North Korea is under heavy sanctions from the US, and the country does not allow its companies to hire, or do business with, individuals and organizations in North Korea.
The FBI shared a long list of wallets it believes contain the stolen funds, and has asked THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from these addresses.
