TraderTraitor
Threat actorSecurity timeline
- Named in breach reports by GBHackersTRM Labs Says North Korea's TraderTraitor Stole About $6.36 Billion From Binance Wallets
- Named in breach reports by Help Net SecurityBinance reports record $6.3 billion crypto theft, possibly via compromised DevOps engineer laptop
Recent news
FBI blames North Korean TraderTraitor group for $6.3B Binance crypto theft
Binance attributed the $6.3 billion theft to a compromised DevOps engineer's laptop, which gave attackers access to a withdrawal service container and let them authorise unauthorised withdrawals. The FBI has attributed the attack to North Korea's TraderTraitor group, linked to Lazarus, and has published wallet addresses tied to the theft. Binance says it has replenished about 95 percent of the stolen assets, resumed withdrawals in phases, and recorded about $3.64 billion in net outflows.
FBI attributes Binance hack to North Korea's TraderTraitor and flags over 600 addresses
The FBI has formally attributed the reported $6 billion Binance hack to North Korea's TraderTraitor group. The agency has flagged more than 600 cryptocurrency addresses tied to the heist, which the attackers are using to launder the stolen funds.
FBI links over $6 billion Binance crypto theft to North Korean group TraderTraitor
The FBI's advisory, released 31 October, attributes the theft of over $6 billion from Binance to the North Korean group TraderTraitor, which the agency previously linked to the Bybit hack of February 2025. Binance initially suspected a compromised DevOps engineer's laptop but has since identified additional breach points, so the full attack path is still under investigation and no exploited vulnerability has been confirmed.
FBI and TRM link North Korea's TraderTraitor group to billion-dollar Binance crypto theft
The FBI and TRM attribute the 29 October attack on Binance to North Korea's TraderTraitor group, with TRM reporting high confidence based on on-chain and off-chain intelligence. TRM says the attacker prepared for about 36 hours, testing code on wallets before installing it on a Binance hot wallet, and that funds moved to addresses controlled by a single attacker across many blockchains. Binance says it will cover losses but has not yet released further details.
FBI attributes over $6 billion Binance crypto theft to North Korea's TraderTraitor
The FBI, with the US Secret Service and IRS-CI, attributes the theft of more than $6 billion from Binance on or about 29 October 2026 to North Korean group TraderTraitor. Attackers reached a service container through an engineer's laptop and sent unauthorised withdrawal requests, and Binance reports no private keys were stolen. Freezes by issuers and others covered only part of the funds, and the attacker still holds over 420,000 ETH and 18,270 BTC.
Binance hit by $6.3bn hack, largest cryptocurrency heist on record
Binance suffered a $6.3 billion theft, reported as the largest cryptocurrency hack to date. Two analytics firms attribute the attack to the North Korean unit TraderTraitor, and Binance has pledged to cover all losses. About $3 billion in assets have been frozen by the exchange and its partners.
FBI links North Korea to $6.3 billion Binance crypto heist
The FBI attributes the $6.3 billion theft from Binance on October 29th to North Korean actors, which it tracks as TraderTraitor. Agency-linked actors were observed converting the stolen tokens to Ethereum and preparing further laundering, but the FBI has offered few other details or evidence.
TRM Labs Says North Korea's TraderTraitor Stole About $6.36 Billion From Binance Wallets
GBHackers reports that TRM Labs attributes the theft of about $6.36 billion from Binance wallets to North Korea's TraderTraitor group. The funds were drained across ten blockchains on 29 October 2026. TRM Labs describes it as the largest crypto theft on record, about four times the $1.5 billion Bybit heist of February 2025.
Binance reports record $6.3 billion crypto theft, possibly via compromised DevOps engineer laptop
Binance said an initial investigation points to a compromised DevOps engineer's laptop that gave an attacker access to a service container, from which unauthorised withdrawals were submitted. The company found no evidence of a wallet private key leak, and co-CEO Richard Teng said the attack was more complex than one engineer's permissions. TRM Labs and Chainalysis link the theft to TraderTraitor, while Elliptic says about $3.3 billion was moved into assets that cannot be frozen.