FBI links over $6 billion Binance crypto theft to North Korean group TraderTraitor
- Severity
- Critical
- Sources
- 2
What happened
The FBI attributes the Binance theft (estimated by Binance at about $6.3 billion, around 29 October 2026) to TraderTraitor, with proceeds converted mainly to Ethereum. TRM Labs reported drained wallets across ten blockchains and malicious sweeper contract activity against an Ethereum hot wallet. No CVE, malware family or complete intrusion chain has been identified, and the initial compromised DevOps laptop is only one of several breach points under review. Exchanges, analytics firms, DeFi providers, THORNode and RPC node operators should block transactions involving the attacker addresses and those derived from them, and monitor for DeFi and instant-swap laundering.
For security analysts · Written by AI from 2 sources · Wrong?
What to do
- Exchanges, blockchain analytics firms, DeFi providers and node operators should block transactions involving the addresses named in the FBI alert and transactions derived from them.
- Anyone with relevant information should contact an FBI field office or submit a report through the Internet Crime Complaint Center.
- Be wary of private crypto recovery services, as the IC3 states it does not partner with them.
Written by AI from the sources, checked against them
Full story timeline · 2 updates
Who reported · 2 outlets
Who and what is in it
Threat actors