FBI attributes $6.3B Binance crypto heist to North Korea's TraderTraitor; scammers exploit withdrawal pause
The FBI confirmed in an alert published October 31 that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026, tying the attack to TraderTraitor, the group named in the $1.5 billion Bybit hack of February 2025. TRM Labs and Chainalysis attributed the heist to the group within a day. Binance said it replaced about 95% of the stolen assets with its own funds and began phased restoration of withdrawals on November 1. Scammers are meanwhile circulating fake posts claiming a $150 compensation reward for affected users.
Detalhes técnicos
- Binance first said the attacker may have gained access through a compromised DevOps engineer's laptop, which allowed access to a service container and unauthorized withdrawals; investigators later found further breaches.
- About $6.3 billion left Binance wallets on October 29; Tether, Circle and partners froze close to $3 billion within the first day.
- The actors converted stolen assets mostly into Ethereum and are expected to launder them through DeFi platforms and instant swap services.
- The FBI alert lists 628 addresses: 608 Ethereum, 19 Bitcoin and 1 Solana.
- Scam campaign: fake social media posts and screenshots claim a $150 Binance compensation reward claimable through the Binance app.
Remediação
- Node operators, instant exchanges, DeFi services, blockchain analytics firms and other crypto providers are urged to block transactions linked to the 628 listed addresses.
- Users should rely only on official Binance channels and announcements and ignore compensation claims.
Linha do tempo
-
FBI attributes $6.3B Binance crypto heist to North Korea's TraderTraitor; scammers exploit withdrawal pause
ler a análise desta fonte ocultar
The FBI confirmed in an alert published October 31 that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026, tying the attack to TraderTraitor, the group named in the $1.5 billion Bybit hack of February 2025. TRM Labs and Chainalysis attributed the heist to the group within a day. Binance said it replaced about 95% of the stolen assets with its own funds and began phased restoration of withdrawals on November 1. Scammers are meanwhile circulating fake posts claiming a $150 compensation reward for affected users.
Technical Details
- Binance first said the attacker may have gained access through a compromised DevOps engineer's laptop, which allowed access to a service container and unauthorized withdrawals; investigators later found further breaches.
- About $6.3 billion left Binance wallets on October 29; Tether, Circle and partners froze close to $3 billion within the first day.
- The actors converted stolen assets mostly into Ethereum and are expected to launder them through DeFi platforms and instant swap services.
- The FBI alert lists 628 addresses: 608 Ethereum, 19 Bitcoin and 1 Solana.
- Scam campaign: fake social media posts and screenshots claim a $150 Binance compensation reward claimable through the Binance app.
Remediation
- Node operators, instant exchanges, DeFi services, blockchain analytics firms and other crypto providers are urged to block transactions linked to the 628 listed addresses.
- Users should rely only on official Binance channels and announcements and ignore compensation claims.