FBI and TRM link North Korea's TraderTraitor group to billion-dollar Binance crypto theft
- Severity
- High
- Sources
- 1
What happened
TRM assesses with high confidence that TraderTraitor, a North Korean cybercrime group, carried out the 29 October 2025 theft from Binance, and the FBI has publicly attributed it to the group. TRM reports the operator wallet received small Tornado Cash withdrawals from 28 October, test code ran on two and then a third wallet, and the final code was installed on a Binance hot wallet about four hours after the final rehearsal. Binance first blamed a single compromised laptop but has since identified additional points of breach. Defenders should review hot wallet access controls, code deployment pipelines and endpoint security, and monitor for funds routed through mixers such as Tornado Cash.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- No action needed.
Written by AI from the sources, checked against them
Full story timeline · 2 updates
Who reported · 1 outlet
Who and what is in it
Threat actors
Companies