TRM Labs
CompanyThreat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Named in breach reports by GBHackersTRM Labs Says North Korea's TraderTraitor Stole About $6.36 Billion From Binance Wallets
- Named in breach reports by Help Net SecurityBinance reports record $6.3 billion crypto theft, possibly via compromised DevOps engineer laptop
Recent news
FBI blames North Korean TraderTraitor group for $6.3B Binance crypto theft
Binance attributed the $6.3 billion theft to a compromised DevOps engineer's laptop, which gave attackers access to a withdrawal service container and let them authorise unauthorised withdrawals. The FBI has attributed the attack to North Korea's TraderTraitor group, linked to Lazarus, and has published wallet addresses tied to the theft. Binance says it has replenished about 95 percent of the stolen assets, resumed withdrawals in phases, and recorded about $3.64 billion in net outflows.
FBI links over $6 billion Binance crypto theft to North Korean group TraderTraitor
The FBI's advisory, released 31 October, attributes the theft of over $6 billion from Binance to the North Korean group TraderTraitor, which the agency previously linked to the Bybit hack of February 2025. Binance initially suspected a compromised DevOps engineer's laptop but has since identified additional breach points, so the full attack path is still under investigation and no exploited vulnerability has been confirmed.
North Korea has stolen USD 12.8 billion in crypto since 2017, USD 7.4 billion of it in 2026
TRM Labs reports that North Korea has stolen USD 12.8 billion in crypto since 2017, including USD 7.4 billion in 2026. The analysis covers a theft from Binance, the laundering of the proceeds, and freezes of the funds.
TRM Labs Says North Korea's TraderTraitor Stole About $6.36 Billion From Binance Wallets
GBHackers reports that TRM Labs attributes the theft of about $6.36 billion from Binance wallets to North Korea's TraderTraitor group. The funds were drained across ten blockchains on 29 October 2026. TRM Labs describes it as the largest crypto theft on record, about four times the $1.5 billion Bybit heist of February 2025.
Binance reports record $6.3 billion crypto theft, possibly via compromised DevOps engineer laptop
Binance said an initial investigation points to a compromised DevOps engineer's laptop that gave an attacker access to a service container, from which unauthorised withdrawals were submitted. The company found no evidence of a wallet private key leak, and co-CEO Richard Teng said the attack was more complex than one engineer's permissions. TRM Labs and Chainalysis link the theft to TraderTraitor, while Elliptic says about $3.3 billion was moved into assets that cannot be frozen.