FBI blames North Korean TraderTraitor group for $6.3B Binance crypto theft
- Severity
- Critical
- Sources
- 3
What happened
Binance attributes the roughly $6.3B withdrawal breach to a compromised DevOps engineer laptop that gave access to a withdrawal service container. Blockaid and F6 describe a single transaction containing a batch of 50 EIP-7702 authorisations and delegation to a malicious sweeper contract, a mechanism F6 says has not been seen before at this scale. The FBI, working with the US Secret Service and IRS-CI, attributes the attack to TraderTraitor and warns of laundering via DeFi and instant-swap services. Defenders should require multi-party authorisation for withdrawals, not allow a single endpoint compromise to authorise transfers, and block transactions involving the wallet addresses the FBI has published.
For security analysts · Written by AI from 3 sources · Wrong?
What to do
- Crypto exchanges and other virtual asset providers should block transactions involving the wallet addresses the FBI has published.
- Security teams should ensure that a compromised employee device cannot alone authorise withdrawals or transfers.
- Organisations should treat privileged developer and administrative identities as high-value targets and monitor them closely.
Written by AI from the sources, checked against them
Full story timeline · 3 updates
Who reported · 3 outlets
Who and what is in it
Threat actors