The FBI formally attributes $6. 7 billion Binance cryptocurrency theft to North Korea’s TraderTraitor group
Investigators say the attackers are laundering stolen assets across multiple blockchains and DeFi services
The breach highlights ongoing threats from Lazarus-linked campaigns targeting crypto, DevOps, and software professionals
The FBI has publicly accused a North Korean state-sponsored threat actor of being behind the recent attack on cryptocurrency exchange Binance . One of the largest cryptocurrency exchange platforms on the planet was forced to freeze deposits and withdrawals, before confirming a threat actor stole around $6. 7 billion worth of different cryptocurrencies. Analysts were quick to investigate, with some claiming a known North Korean state-sponsored group called TraderTraitor was behind the heist. TraderTraitor is apparently part of Lazarus Group – a huge cybercriminal operation on North Korea’s payroll, allegedly tasked with stealing money to fund the country’s state apparatus and weapons program. TraderTraitor
Now, the FBI has issued a new statement , official naming TraderTraitor as the attackers. “The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as ‘TraderTraitor’. ,” the announcement reads. “The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.” Binance said one of its DevOps engineers had their laptop compromised which “gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.” Some speculated the engineer fell to a classic fake job scam, while others argued it was a romance scam. In the meantime, Binance resumed operations and has covered most of its losses…