FBI attributes $6B Binance crypto theft to North Korea's TraderTraitor (Lazarus/APT38)
The FBI has attributed the theft of more than $6 billion in virtual assets from the Binance exchange, on or about October 29, 2026, to North Korea's TraderTraitor cluster, also tracked as Lazarus Group and APT38. TRM was first to attribute the attack to TraderTraitor and Chainalysis also expressed high confidence, while Binance has not named a culprit. TRM says about $6.36 billion left Binance wallets on ten blockchains, mostly within about 20 minutes from 20:05 UTC, making this the largest crypto theft on record, roughly four times the Bybit hack of February 2025. The FBI, USSS and IRS-CI are asking crypto service providers to block transactions tied to the actor's wallet addresses as the funds are laundered.
Detalhes técnicos
- Attackers used access from an engineer's laptop to reach a service container and send unauthorized withdrawal requests. Binance says it found no evidence that wallet private keys were stolen.
- The agencies observed the actors converting stolen assets primarily into Ethereum (ETH), with further laundering expected through DeFi and instant swap services.
- Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB (roughly $2.7 billion in all). Early reports put the Tether and Circle freezes at about $1.79 billion; the figures describe different moments and should not be summed blindly.
- The attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer's reach.
Remediação
- THORNode operators, RPC node operators, instant exchanges, DeFi platforms, blockchain analytics firms and other crypto service providers should block transactions involving the TraderTraitor wallet addresses listed in the FBI alert, including funds derived from them.
- Check blocklists against the FBI list and review transaction flows that touch those addresses indirectly.
- Information can be reported to a local FBI field office or ic3.gov.
Linha do tempo
-
FBI attributes $6B Binance crypto theft to North Korea's TraderTraitor (Lazarus/APT38)
ler a análise desta fonte ocultar
The FBI has attributed the theft of more than $6 billion in virtual assets from the Binance exchange, on or about October 29, 2026, to North Korea's TraderTraitor cluster, also tracked as Lazarus Group and APT38. TRM was first to attribute the attack to TraderTraitor and Chainalysis also expressed high confidence, while Binance has not named a culprit. TRM says about $6.36 billion left Binance wallets on ten blockchains, mostly within about 20 minutes from 20:05 UTC, making this the largest crypto theft on record, roughly four times the Bybit hack of February 2025. The FBI, USSS and IRS-CI are asking crypto service providers to block transactions tied to the actor's wallet addresses as the funds are laundered.
Technical Details
- Attackers used access from an engineer's laptop to reach a service container and send unauthorized withdrawal requests. Binance says it found no evidence that wallet private keys were stolen.
- The agencies observed the actors converting stolen assets primarily into Ethereum (ETH), with further laundering expected through DeFi and instant swap services.
- Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB (roughly $2.7 billion in all). Early reports put the Tether and Circle freezes at about $1.79 billion; the figures describe different moments and should not be summed blindly.
- The attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer's reach.
Remediation
- THORNode operators, RPC node operators, instant exchanges, DeFi platforms, blockchain analytics firms and other crypto service providers should block transactions involving the TraderTraitor wallet addresses listed in the FBI alert, including funds derived from them.
- Check blocklists against the FBI list and review transaction flows that touch those addresses indirectly.
- Information can be reported to a local FBI field office or ic3.gov.