FBI attributes over $6 billion Binance crypto theft to North Korea's TraderTraitor
- Severity
- High
- Sources
- 4
What happened
FBI alert attributes the 29 October 2026 Binance outflow to TraderTraitor (aliases Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, UNC4899, and per Security Affairs Lazarus Group/APT38). Access was gained via an engineer's laptop to a service container that issued unauthorised withdrawals; Binance reports no wallet private keys were stolen. Funds are being converted mainly to ETH for laundering through DeFi and instant swaps. TRM estimates about $6.36 billion moved across ten chains, and reporting cites $6.3 to $6.43 billion, so figures vary. Operators of THORNode, RPC nodes, instant exchanges, DeFi platforms and analytics services should check blocklists against the FBI address list and block funds derived from those addresses.
For security analysts · Written by AI from 4 sources · Wrong?
What to do
- Operators of crypto exchanges, DeFi platforms, RPC nodes and similar services should check their blocklists against the FBI's published list of TraderTraitor addresses.
- Block transactions derived from those addresses, not just direct transfers, as the FBI advises.
- Report any relevant information to a local FBI field office or the Internet Crime Complaint Center (ic3.gov).
Written by AI from the sources, checked against them
Full story timeline · 4 updates
- Sun 1 NovemberFBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto HeistThe Hacker News
- FBI Blames North Korea for $6 Billion Binance Crypto TheftSecurity Affairs
- FBI links $6.3 billion Binance crypto heist to North Korean hackersBleepingComputer
- Mon 2 NovemberFBI Attributes Binance Heist to North Korea’s TraderTraitorInfosecurity Magazine
Who reported · 4 outlets
Who and what is in it
Threat actors