Binance loses $6.3 billion in record crypto heist attributed to North Korea's TraderTraitor; losses covered, about $3 billion traced
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 14/11/2026 00:04; os links antigos trazem para cá.
On October 29, 2026, attackers stole about $6.3 billion in cryptocurrency from Binance in roughly 20 minutes, the largest crypto heist on record (olhardigital.com.br). Binance and the FBI attribute the theft to TraderTraitor, a North Korean state-linked cluster known for targeting exchanges and developers (techcrunch.com). The FBI ties the group to North Korea's military (olhardigital.com.br). On November 13, Binance announced it had fully covered the lost assets with its own funds and the SAFU emergency fund, and said customer balances are intact as shown by an updated Proof of Reserves (olhardigital.com.br). The US Department of Justice (DOJ) and other authorities have seized or frozen significant amounts of the stolen funds, with combined efforts locating around $3 billion (olhardigital.com.br). Binance froze withdrawals for several days; after accounts reopened, users pulled a net $3.6 billion within the first hours (techcrunch.com). Separately, CFO Kaiser Ng is leaving after more than five years. Co-CEO Yi He called it a move to "pursue a new venture" with a transition plan in place for six months (techcrunch.com, citing Bloomberg). Separately, US authorities disrupted a cloud infrastructure used in a $400 million deepfake-based crypto fraud scheme targeting Web3 professionals (olhardigital.com.br). No source links that scheme to this heist.
Detalhes técnicos
No source describes the intrusion vector, the wallet infrastructure involved, the malware, the laundering path or any indicators. No CVE is named, and no public Binance post-mortem is cited (techcrunch.com). The attribution rests on statements from Binance and the FBI (techcrunch.com, olhardigital.com.br). The cited sources do not describe the technical evidence behind it.
Remediação
The following is guidance from techcrunch.com, not a vendor or government advisory. Exchanges and crypto-adjacent firms should review the controls that TraderTraitor operations typically target:
- Harden developer and treasury workstations.
- Enforce strict segregation and multi-party approval for hot and cold wallet signing.
- Verify third-party build and CI dependencies.
- Scrutinize unsolicited recruiter or business-development contacts.
Institutional users should monitor counterparty exposure to Binance and withdrawal availability during any renewed freeze (techcrunch.com).
Relatos divergentes
- Loss coverage: the earlier report said Binance would absorb the losses and not pass them on to users (techcrunch.com, November 7). The later report says Binance announced on November 13 that it had fully covered them with its own funds and SAFU (olhardigital.com.br). The later source is more current.
- Recovered funds: olhardigital.com.br says authorities seized or froze significant amounts and "located" about $3 billion. It does not say how much has actually been seized or returned, so the recovery figure is unconfirmed.
- Attribution wording: techcrunch.com describes TraderTraitor as a state-linked cluster. olhardigital.com.br says the FBI links it to North Korea's military. These are compatible descriptions, not a contradiction.
Linha do tempo
-
Binance covers $6.3 billion loss from largest crypto hack attributed to North Korean military
ler a análise desta fonte ocultar
On October 29, 2026, Binance suffered the largest cryptocurrency heist in history, with attackers stealing approximately $6.3 billion in about 20 minutes. Binance announced on November 13 that it has fully covered the lost assets using its own funds and the SAFU emergency fund, ensuring customers' balances remain intact as validated by its updated Proof of Reserves. Meanwhile, the US Department of Justice (DOJ) and other authorities have seized and frozen significant amounts of the stolen funds, with combined efforts locating around $3 billion. The FBI attributes the attack to the traderTraitor group linked to North Korea's military. This incident has shaken confidence in crypto security. Additionally, US authorities disrupted a cloud infrastructure used in a $400 million deepfake-based crypto fraud scheme targeting Web3 professionals.
-
Binance CFO Kaiser Ng departs days after $6.3 billion crypto theft blamed on North Korea's TraderTraitor
ler a análise desta fonte ocultar
Binance chief financial officer Kaiser Ng is leaving the cryptocurrency exchange, little more than a week after attackers stole $6.3 billion in cryptocurrency from Binance users. Co-CEO Yi He framed the exit as a move to "pursue a new venture" after more than five years at the company, stating a transition plan had been implemented over the previous six months (reported by Bloomberg via techcrunch.com). Binance and the FBI attributed the theft to TraderTraitor, a North Korean state-linked threat cluster known for targeting cryptocurrency exchanges and developers. The exchange froze withdrawals for several days; once accounts were reopened, users pulled a net $3.6 billion within the first hours. Binance said it will absorb the losses and not pass them on to users. The article does not describe the intrusion vector, malware or indicators, and no public Binance incident post-mortem is cited.
Technical Details
No technical detail on the initial access, the wallet infrastructure involved or the laundering path is provided in the article. Attribution to TraderTraitor comes from Binance and the FBI; the article names no CVE, no malware sample and no indicators.
Remediation
Exchanges and crypto-adjacent firms should review the controls that TraderTraitor operations typically target: developer and treasury workstation hardening, strict segregation and multi-party approval for hot and cold wallet signing, verification of third-party build and CI dependencies, and heightened scrutiny of unsolicited recruiter or business-development contacts. Institutional users should monitor counterparty exposure to Binance and withdrawal availability during any renewed freeze.