FBI Attributes $6.43 Billion Binance Theft to North Korean TraderTraitor
The U.S. Federal Bureau of Investigation has attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korea-aligned hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899. The reported $6.43 billion haul is described as the largest cryptocurrency theft on record.
The FBI said it worked with the U.S. Secret Service and Internal Revenue Service Criminal Investigation to track the movement of the stolen funds. The agencies observed the actor converting stolen assets primarily into Ethereum. The FBI expects the assets to be further laundered through DeFi and instant-swap services and has published wallet addresses allegedly used in that activity.
Binance said it resumed phase-one withdrawals between 6 a.m. and 9 a.m. UTC after pausing them following the incident. The exchange said it had taken precautionary measures, conducted security assessments and was progressively restoring withdrawals as affected services passed security and readiness checks. Deposit services remained open.
A theft larger than previous crypto heists
The $6.43 billion theft exceeds the $1.46 billion taken from Bybit in February 2025. The assets were stolen across 11 blockchains, with Ethereum and Bitcoin accounting for 82% of the total. Elliptic said the event almost doubles the cryptoassets believed to have been stolen by North Korea-linked actors in recent years, a total it placed above $6.5 billion.
Some recovery action has already been taken. Tether, Circle, Ripple, Arbitrum and Optimism have frozen $2.85 billion of the stolen assets on-chain. The difference between the stolen amount and the frozen amount underscores the operational challenge: funds can be moved across chains, exchanged through decentralized services and converted into other assets while defenders attempt to identify and block relevant wallets.
Developer workflows and recruitment lures remain in scope
TraderTraitor has been active since at least 2020 and has been linked to cryptocurrency thefts involving DMM Bitcoin, Bybit, KelpDAO and Bitget. Its campaigns target the Web3 industry by persuading victims to download malware-laced applications.
Research from SentinelOne, Zscaler ThreatLabz and Microsoft describes a broader intrusion toolkit. The group has used trojanized Terraform providers as a delivery mechanism and front companies for job-themed outreach aimed at people working in cybersecurity, AI, blockchain and talent recruitment. A poisoned provider can deliver a Bash loader that selects malware for the victim's operating system.
The chain includes FLATROOF, a cross-platform implant that uses a Python-based information stealer to collect sensitive data, followed by the ROOFDECK backdoor for remote control. The reported targeting spans macOS, Linux and Windows systems, showing how a trusted developer workflow can become an entry point for persistent access.
Practical implication for organisations
Microsoft said Jade Sleet used tailored domains, social-media profiles and industry knowledge to impersonate recruiters from a spoofed AI-powered blockchain intelligence company. It also used AI to create convincing lures and fake personas. Businesses handling cryptoassets or employing technical staff should verify recruiter contacts, review third-party Terraform components before use, and monitor for unauthorised loaders, data collection and wallet-related activity as part of the same security response.