FBI attributes record $6.3B Binance crypto heist to North Korea's TraderTraitor (Lazarus)
The FBI has attributed the October 29 theft of roughly $6.3 billion in cryptocurrency from Binance to TraderTraitor, a North Korean operation linked to Lazarus Group. Blockchain intelligence firms TRM Labs and Elliptic had already tied the theft to North Korea; TRM said most of the haul moved in about 20 minutes, and Elliptic verified that $2.85 billion has been frozen or seized. Binance says it has replenished about 95% of the stolen assets and resumed withdrawals, but recorded about $3.64 billion in net outflows (around 2.1% of reported assets).
Detalhes técnicos
- Per Binance, the intrusion began with a compromised DevOps engineer's laptop, which gave the attackers access to a service container and let them authorize illegitimate withdrawals.
- The FBI says the actors are swapping the loot for Ethereum and are expected to launder it through DeFi platforms and instant swap services.
- TraderTraitor has previously used fake job offers and recruitment exercises to gain access to employers' systems, and has been linked to the $308 million DMM Bitcoin theft in 2024.
- Bitget separately confirmed that its $387.5 million theft also bears hallmarks of a North Korean operation, citing "IP behavioral patterns and on-chain signatures".
Remediação
- The FBI published a list of wallet addresses linked to the theft and urges exchanges, blockchain analytics firms and other virtual asset providers to block transactions involving the stolen funds.
Linha do tempo
-
FBI attributes record $6.3B Binance crypto heist to North Korea's TraderTraitor (Lazarus)
ler a análise desta fonte ocultar
The FBI has attributed the October 29 theft of roughly $6.3 billion in cryptocurrency from Binance to TraderTraitor, a North Korean operation linked to Lazarus Group. Blockchain intelligence firms TRM Labs and Elliptic had already tied the theft to North Korea; TRM said most of the haul moved in about 20 minutes, and Elliptic verified that $2.85 billion has been frozen or seized. Binance says it has replenished about 95% of the stolen assets and resumed withdrawals, but recorded about $3.64 billion in net outflows (around 2.1% of reported assets).
Technical Details
- Per Binance, the intrusion began with a compromised DevOps engineer's laptop, which gave the attackers access to a service container and let them authorize illegitimate withdrawals.
- The FBI says the actors are swapping the loot for Ethereum and are expected to launder it through DeFi platforms and instant swap services.
- TraderTraitor has previously used fake job offers and recruitment exercises to gain access to employers' systems, and has been linked to the $308 million DMM Bitcoin theft in 2024.
- Bitget separately confirmed that its $387.5 million theft also bears hallmarks of a North Korean operation, citing "IP behavioral patterns and on-chain signatures".
Remediation
- The FBI published a list of wallet addresses linked to the theft and urges exchanges, blockchain analytics firms and other virtual asset providers to block transactions involving the stolen funds.