Binance Hack: FBI Blames North Korea's TraderTraitor

The FBI has attributed the Binance hack, the theft of about $6.4 billion in cryptocurrency in late October 2026, to TraderTraitor, a North Korean state-aligned group also tracked as Jade Sleet and UNC4899. It is the largest crypto theft on record, more than four times the $1.46 billion Bybit heist in 2025. Binance says the intrusion began with a compromised DevOps engineer's laptop, and roughly $2.85 billion has been frozen on-chain.

Binance disclosed the incident on October 30, saying a security incident had affected about $6.3 billion in assets and that it had paused deposits and withdrawals. Its initial update, reported by The Hacker News, said a compromised DevOps engineer's laptop let the attacker reach a service container and submit unauthorized withdrawal transactions, with no evidence that wallet private keys leaked. Binance said it would cover all user losses from its SAFU fund and its own funds. CEO Richard Teng later said investigators had found "additional points of breach" and that the attacker used a self-destruct mechanism to wipe tooling and traces as they went, according to The Record.

Over the weekend the FBI, the U.S. Secret Service and IRS Criminal Investigation formally named TraderTraitor and published wallet addresses the group is using to launder funds, urging exchanges and DeFi operators to block related transactions. The agencies said the actors were converting stolen assets mainly into Ethereum ahead of further laundering through DeFi and instant swap services. Binance reopened withdrawals in phases from November 1.

How did North Korea's TraderTraitor steal $6.4 billion from Binance?

The full chain has not been published, but the pieces disclosed so far fit a pattern. TRM Labs, which attributed the attack with high confidence before the FBI, said preparation started at least 36 hours before the theft. Signatures were obtained in advance and then executed in one burst: at 20:20 UTC the operator submitted a single transaction carrying 50 authorizations signed by a Binance hot wallet, each pointing the wallet at a sweeper contract that took instructions only from the attacker. TRM noted the same hallmarks as the Bybit and KelpDAO heists, including small Tornado Cash withdrawals to fund an operator wallet, while the laundering this time relied on large swaps through market makers and lending protocols rather than bridges.

Who is TraderTraitor and how does it get in?

TraderTraitor has been active since at least 2020 and has been linked to the DMM Bitcoin, Bybit, KelpDAO and Bitget thefts. Its entry point is usually a person, not a perimeter device. The group runs recruitment-themed lures and front companies to convince developers and engineers to run malicious code, and researchers at SentinelOne, Zscaler ThreatLabz and Microsoft have documented it distributing malware through trojanized Terraform providers. That poisoned provider drops a Bash loader that fetches an OS-specific implant called FLATROOF, which steals data before installing the ROOFDECK backdoor for full remote control across macOS, Linux and Windows.

What should crypto and fintech teams do now?

Start with the engineers who hold production access, because that is where this group aims. Treat unsolicited job offers, coding tests and "take-home" repositories as an infection vector, and run them only in isolated environments. Pin and verify infrastructure-as-code providers and modules with a Terraform dependency lock file rather than pulling whatever a README links to, and use build provenance such as SLSA for what you ship. Separate signing authority from the machines engineers browse and code on, and require out-of-band approval for any change to hot-wallet authorization or withdrawal services. If you run an exchange or DeFi service, load the FBI's published addresses into your screening now.

Our read

The striking detail here is not the size, it is how ordinary the first step was: one engineer's laptop. Everything after that, the staged signatures and the sweeper contracts, depended on trusted developer access that nobody had a reason to question. That is the same pattern behind the Coder registry compromise and the trojanized Terraform providers attributed to this group: attackers go where developers already trust the input. For fintechs, the defensive work is unglamorous and verifiable, from checking what your IaC pulls in to proving who can authorize a withdrawal. Our software supply chain attack guide and fintech startup security checklist cover where to start, and ARGUS scans Terraform and other IaC in every pull request.

Reporting by The Hacker News (attribution) and The Record; attribution and laundering details per the FBI, USSS and IRS-CI statements and TRM Labs.

Frequently asked questions

Who hacked Binance?
The FBI attributed the October 2026 Binance theft to TraderTraitor, a North Korean state-aligned group also tracked as Jade Sleet, Pressure Chollima, Slow Pisces and UNC4899.

How much was stolen from Binance?
About $6.43 billion according to the FBI-linked figures reported by The Hacker News, with about $2.85 billion frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism.

How did the Binance hack start?
Binance said its initial investigation pointed to a compromised DevOps engineer's laptop that gave the attacker access to a service container, and later said it found additional points of breach.

Is the Binance hack bigger than Bybit?
Yes. At about $6.4 billion it is more than four times the roughly $1.46 billion stolen from Bybit in February 2025, making it the largest crypto theft on record.

Are Binance users' funds safe?
Binance says it will cover all losses from its SAFU fund and its own funds, and it began restoring withdrawals in phases on November 1, 2026.