FBI attributes $6.3B Binance crypto heist to North Korea's TraderTraitor (Lazarus)
The FBI has formally attributed the theft of roughly $6.3-6.36 billion in virtual assets from Binance, on or about October 29, 2026, to North Korea's TraderTraitor (also tracked as Lazarus Group, Jade Sleet and APT38). It is the largest cryptocurrency heist on record. The attribution follows earlier links made by TRM Labs and Chainalysis. Binance previously tied the breach to a compromised DevOps engineer's laptop, which gave the attackers access to a service container from which they submitted unauthorized withdrawals across ten blockchains, mostly within 20 minutes. Binance says it has covered about 95% of the impacted amount and plans to resume the first phase of withdrawals on November 1.
Detalhes técnicos
- The attackers used the compromised DevOps laptop to reach a service container and submit unauthorized withdrawal transactions, per Binance.
- The FBI observed TraderTraitor converting stolen assets mainly into Ethereum (ETH) and expects further laundering through DeFi platforms and instant swap services.
- The FBI published 628 associated addresses: 608 Ethereum, 19 Bitcoin and 1 Solana.
- Prior TraderTraitor thefts cited: Bitget ($387.5M, Sep 2026), Drift ($280M, Apr 2026), Bybit ($1.5B, Feb 2025) and DMM Bitcoin ($308M, May 2024). These involved developer or employee compromise through fake recruiter approaches (Operation DreamJob), malicious Python code disguised as a pre-employment test, a compromised Safe{Wallet} developer machine, and a six-month in-person social engineering campaign against Drift contributors.
Remediação
- The FBI, U.S. Secret Service and IRS Criminal Investigation ask exchanges, blockchain operators and other virtual asset service providers to block transactions linked to the published addresses.
- Defenders at crypto firms should harden developer and DevOps endpoints and train staff on fake-recruiter and conference-based social engineering.
- Binance states it will bear the losses, that users will not, and that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are fully backed.
Linha do tempo
-
FBI attributes $6.3B Binance crypto heist to North Korea's TraderTraitor (Lazarus)
ler a análise desta fonte ocultar
The FBI has formally attributed the theft of roughly $6.3-6.36 billion in virtual assets from Binance, on or about October 29, 2026, to North Korea's TraderTraitor (also tracked as Lazarus Group, Jade Sleet and APT38). It is the largest cryptocurrency heist on record. The attribution follows earlier links made by TRM Labs and Chainalysis. Binance previously tied the breach to a compromised DevOps engineer's laptop, which gave the attackers access to a service container from which they submitted unauthorized withdrawals across ten blockchains, mostly within 20 minutes. Binance says it has covered about 95% of the impacted amount and plans to resume the first phase of withdrawals on November 1.
Technical Details
- The attackers used the compromised DevOps laptop to reach a service container and submit unauthorized withdrawal transactions, per Binance.
- The FBI observed TraderTraitor converting stolen assets mainly into Ethereum (ETH) and expects further laundering through DeFi platforms and instant swap services.
- The FBI published 628 associated addresses: 608 Ethereum, 19 Bitcoin and 1 Solana.
- Prior TraderTraitor thefts cited: Bitget ($387.5M, Sep 2026), Drift ($280M, Apr 2026), Bybit ($1.5B, Feb 2025) and DMM Bitcoin ($308M, May 2024). These involved developer or employee compromise through fake recruiter approaches (Operation DreamJob), malicious Python code disguised as a pre-employment test, a compromised Safe{Wallet} developer machine, and a six-month in-person social engineering campaign against Drift contributors.
Remediation
- The FBI, U.S. Secret Service and IRS Criminal Investigation ask exchanges, blockchain operators and other virtual asset service providers to block transactions linked to the published addresses.
- Defenders at crypto firms should harden developer and DevOps endpoints and train staff on fake-recruiter and conference-based social engineering.
- Binance states it will bear the losses, that users will not, and that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are fully backed.