FBI Links North Korea to $6.3 Billion Binance Crypto Heist

The FBI has attributed the theft of over $6.3 billion in cryptocurrency from Binance, the world’s largest exchange, to TraderTraitor, a North Korea-aligned hacking group. The heist, which occurred around October 29, 2026, represents the largest cryptocurrency theft on record, eclipsing a $1.5 billion hack of Bybit in 2025. The FBI, along with the US Secret Service and IRS-CI, observed the actors converting stolen assets primarily into Ethereum with plans to further launder them through DeFi and instant swap services. Approximately $2.85 billion of the stolen assets have been frozen by Tether, Circle, Ripple, Arbitrum, and Optimism.

The attack involved the rapid movement of funds, billions of dollars’ worth, across 11 blockchains within approximately 20 minutes, with 82% of the stolen funds on Ethereum and Bitcoin. Blockchain analysis firms TRM Labs and Chainalysis independently linked the theft to TraderTraitor, a group also known by several aliases including Jade Sleet and Pressure Chollima, which has previously targeted the digital asset industry. Elliptic estimates this single incident nearly doubles the total amount of cryptocurrency stolen by North Korea in recent years, bringing the total to over $6.5 billion.

Binance paused and then resumed phase one of withdrawals after the incident, stating it conducted security assessments and verified affected services. The agency has provided a list of wallet addresses used in the laundering process. The FBI noted the group has been active since at least 2020, employing tactics such as malware-laced applications and trojanized Terraform providers to distribute malware and target individuals in cybersecurity, AI, and blockchain fields. The method of access involved exploiting an Ethereum network mechanism, EIP-7702, to gain control of wallets without standard authorization, and a self-destruct mechanism to erase traces, according to Binance co-chief executive Richard Teng. Customer losses will be covered by the company’s protection fund and resources.

Where they differ

• Opindia emphasized the speed of the heist, noting the bulk of the cryptocurrency was moved within approximately 20 minutes.
• Mercopress detailed the technical aspects of the attack, including the exploitation of the EIP-7702 mechanism and the use of a self-destruct mechanism to erase traces.
• The Verge provided a concise summary of the FBI's statement and Binance's response, focusing on the immediate aftermath of the hack.
• BleepingComputer highlighted the FBI's confirmation of North Korean state-sponsored hackers being behind the attack.

What is not yet known

• The precise method through which the attackers initially gained access to Binance’s wallet infrastructure remains under investigation.
• The extent to which the stolen funds will ultimately be recovered is uncertain, despite the freezing of a portion of the assets.

Was this useful? 👍 0 👎 0

---

Read the original coverage