"The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026," the FBI said.
FBI links the $6.36 billion heist to TraderTraitor (aka Lazarus Group, APT38)
The FBI formally attributed the October 29, 2026 theft of cryptocurrency from Binance to a North Korean state-sponsored hacking group the agency calls TraderTraitor—also tracked under the names Lazarus Group, Jade Sleet, and APT38. This official attribution follows prior blockchain-analysis work by TRM Labs and Chainalysis, which had already linked the events to the same group.
How the attackers gained access: a compromised DevOps engineer laptop and a service container
Binance traced the intrusion to a compromised DevOps engineer's laptop. That compromise, the exchange said, allowed the attackers to access a service container and submit unauthorized withdrawal transactions. The breach mechanism mirrors earlier incidents in which attackers targeted employees or developers with access to infrastructure.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageScale, speed, and laundering patterns: ten blockchains, most funds moved in 20 minutes
The attackers stole approximately $6.36 billion in cryptocurrency spanning ten blockchains, the FBI reported, and moved the bulk of those funds in roughly a 20-minute window. The FBI has observed TraderTraitor converting stolen assets primarily into Ethereum (ETH) and expects the funds will be further laundered through decentralized finance (DeFi) platforms and instant cryptocurrency swap services.
To assist with interdiction, the FBI published a list of 628 cryptocurrency addresses it associates with the theft: 608 Ethereum addresses, 19 Bitcoin addresses, and a single Solana address. The FBI, the U.S. Secret Service, and IRS Criminal Investigation have asked cryptocurrency exchanges, blockchain operators, and other virtual asset service providers to block transactions tied to those addresses.
TraderTraitor's pattern: prior thefts and the 'Operation DreamJob' tactic
The FBI emphasized that TraderTraitor has an established history of targeting cryptocurrency companies and their employees. The group has been linked to a string of high-value incidents, including the $387.5 million Bitget theft in September 2026, the $280 million Drift attack in April 2026, the $1.5 billion Bybit heist in February 2025, and the $308 million DMM Bitcoin theft in May 2024.
One recurring strategy noted by investigators is a long-running social-engineering campaign called "Operation DreamJob," in which operators impersonate recruiters and approach software developers and cryptocurrency employees with fake job offers to trick targets into installing malware. The advisory cites concrete examples: in the DMM Bitcoin attack, a LinkedIn impersonation led a Ginco employee to run malicious Python code disguised as a pre-employment test; in the Bybit case, a compromised Safe{{Wallet}} developer's computer allowed manipulation of a legitimate transaction request and the redirection of $1.5 billion to attacker-controlled wallets.
The April 2026 Drift attack likewise involved a prolonged, in-person social-engineering effort. Individuals posing as representatives of a trading firm met Drift contributors at multiple industry conferences over six months, and are believed to have compromised employees' devices via a malicious code repository or a TestFlight application.
FBI, U.S. Secret Service, IRS-CI, and Binance response: blocks, recovery, and withdrawals
The FBI-led notice asks service providers across the virtual-asset ecosystem to block transactions associated with the 628 addresses the agency published. The FBI has also observed laundering behaviors and warned that DeFi and instant-swap services are likely conduits.
Binance told BleepingComputer it planned to resume the first phase of withdrawals on November 1 between 06:00 and 09:00 UTC while continuing to restore services and cover the stolen assets. The exchange said it has covered approximately 95% of the impacted amount, up from 90% in a prior update; the remaining roughly 5% consists of less-liquid tokens that Binance said it is purchasing through market and over-the-counter channels.
Binance also stated that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC balances are fully backed and that deposit services remain unaffected. "Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users," the exchange said.
What this means for security teams, cryptocurrency exchanges, and users
- Security teams: Expect a renewed emphasis on supply-chain and employee-targeted social engineering, since the FBI highlights repeated compromises of developers' and employees' devices—often following recruiter-style lures.
- Cryptocurrency exchanges and blockchain operators: The FBI and partner agencies have asked these entities to block transactions tied to the 628 published addresses; operators will also contend with rapid conversion into ETH and likely movement through DeFi and instant-swap services.
- Binance users: The exchange says withdrawals will resume in a phased way and that it is covering roughly 95% of the affected amount, while continuing to purchase remaining less-liquid tokens to make users whole.
This incident underscores a repeated pattern laid out by the FBI: high-value, employee-focused compromises followed by rapid on-chain consolidation and conversion. Law enforcement has published concrete addresses and is asking service providers to block them; Binance is restoring withdrawals and buying back illiquid tokens. The immediate operational questions—whether blocked addresses and on-chain tracing will stop laundering through DeFi, and whether the remaining tokens can be purchased without market disruption—are now practical problems being worked in public.
