FBI attributes $6.3B Binance theft to North Korea's TraderTraitor after compromise of an engineer's laptop
The FBI has formally attributed to North Korea the theft of about US$ 6.3 billion in digital assets from Binance, the world's largest cryptocurrency exchange, carried out around 29 October. The FBI says the operation was conducted by TraderTraitor, a state-sponsored group that CISA describes as part of Lazarus Group. The attackers were seen converting part of the loot into Ether, and the FBI expects laundering through DeFi platforms and instant swap services. It asked industry firms to block transactions tied to the group's addresses. Binance says it has covered 95% of the stolen assets with its own funds, and about US$ 3 billion has been located with partners. Withdrawals began resuming on 1 November.
Detalhes técnicos
- Binance co-CEO Richard Teng described a complex attack involving several vulnerabilities.
- Initial findings suggest a compromised laptop belonging to a company engineer served as the entry point, giving access to an internal system used to authorize unauthorized withdrawals.
- The attackers reportedly used malware designed to erase evidence of their activity, hampering tracing and investigation.
- Most funds were drained in about 20 minutes on the night of 29 October.
- TraderTraitor has been active since at least 2020 and uses spear phishing and malware distribution. It was also linked to the roughly US$ 1.5 billion Bybit theft in February 2025.
- Private blockchain analytics firms had pointed to North Korean involvement before the FBI statement.
Remediação
- Crypto industry firms are asked by the FBI to block transactions related to the digital addresses used by the group.
- Binance suspended deposits and withdrawals, worked with partners to freeze assets, and replenished funds from SAFU, its futures insurance fund and corporate cash.
Linha do tempo
-
FBI attributes $6.3B Binance theft to North Korea's TraderTraitor after compromise of an engineer's laptop
ler a análise desta fonte ocultar
The FBI has formally attributed to North Korea the theft of about US$ 6.3 billion in digital assets from Binance, the world's largest cryptocurrency exchange, carried out around 29 October. The FBI says the operation was conducted by TraderTraitor, a state-sponsored group that CISA describes as part of Lazarus Group. The attackers were seen converting part of the loot into Ether, and the FBI expects laundering through DeFi platforms and instant swap services. It asked industry firms to block transactions tied to the group's addresses. Binance says it has covered 95% of the stolen assets with its own funds, and about US$ 3 billion has been located with partners. Withdrawals began resuming on 1 November.
Technical Details
- Binance co-CEO Richard Teng described a complex attack involving several vulnerabilities.
- Initial findings suggest a compromised laptop belonging to a company engineer served as the entry point, giving access to an internal system used to authorize unauthorized withdrawals.
- The attackers reportedly used malware designed to erase evidence of their activity, hampering tracing and investigation.
- Most funds were drained in about 20 minutes on the night of 29 October.
- TraderTraitor has been active since at least 2020 and uses spear phishing and malware distribution. It was also linked to the roughly US$ 1.5 billion Bybit theft in February 2025.
- Private blockchain analytics firms had pointed to North Korean involvement before the FBI statement.
Remediation
- Crypto industry firms are asked by the FBI to block transactions related to the digital addresses used by the group.
- Binance suspended deposits and withdrawals, worked with partners to freeze assets, and replenished funds from SAFU, its futures insurance fund and corporate cash.