“The FBI has blamed North Korean hackers” for a record-breaking seizure of cryptocurrency — roughly $6.3 billion taken from Binance in an October 29 attack that the agency now attributes to TraderTraitor, a North Korean operation tied to the Lazarus Group.
FBI attribution: TraderTraitor, Lazarus Group, and published indicators
The FBI published an alert naming TraderTraitor — linked to the Lazarus Group — as responsible for the October 29 theft. The agency released a list of cryptocurrency wallet addresses tied to the incident and urged exchanges, blockchain analytics firms, and other virtual-asset providers to block transactions involving the stolen funds. According to the FBI, the attackers have begun swapping loot into Ethereum and are expected to move funds through decentralized finance (DeFi) platforms and instant-swap services to complicate tracing.
Tracing and freezes: what blockchain intelligence found
Blockchain intelligence firms had already connected the theft to North Korea before the FBI’s announcement. TRM Labs reported that most of the $6.36 billion haul vanished in about 20 minutes. Elliptic estimated the total closer to $6.43 billion and said it has verified that $2.85 billion of the stolen assets have been frozen or seized. Those differing totals and partial freezes highlight a core reality of large crypto heists: on-chain visibility can reveal movement quickly, but turning visibility into recoveries and seizures is a separate, often slow, process.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildHow Binance says the breach happened and its financial response
Binance told customers the intrusion began with a compromised DevOps engineer’s laptop. That access, the exchange said, allowed intruders into a service container and permitted them to authorize withdrawals they should not have been able to approve. Binance suspended withdrawals after the attack, later resuming them. The company reported it has replenished about 95 percent of the stolen assets, committing billions of dollars from its own reserves and emergency funds to cover losses. Co-CEO Richard Teng promised that customers “won't be left footing the bill.” Despite that pledge, Binance recorded approximately $3.64 billion in net outflows after withdrawals resumed — roughly 2.1 percent of its reported assets — and said the remaining tokens are harder to replace because of limited liquidity.
TraderTraitor’s pattern and related attacks
The FBI’s naming of TraderTraitor comes with historical context from the same reporting: the group has previously been linked to a string of crypto thefts, including a $308 million attack on Japan’s DMM Bitcoin exchange in 2024. The group has used social-engineering lures — fake job offers and recruitment exercises — to trick employees into surrendering access to employer systems. Separately, Bitget confirmed a recent $387.5 million wallet drain showed similar signatures; Bitget’s CEO said “IP behavioral patterns and on-chain signatures” point to “Kim’s cronies at work.” Binance itself has prior experience with a major loss when attackers exploited its BNB blockchain bridge in 2022 and stole roughly $566 million in tokens.
What this means for exchanges, investigators, and customers
- Exchanges and security teams: Expect immediate operational activity to block the FBI-published wallet addresses, to monitor DeFi routes and instant-swap services, and to prioritize liquidity management for hard-to-replace tokens. Binance’s deployment of reserves and emergency funds underlines how large platforms may rely on internal capital to absorb shock while investigators pursue on-chain remedies.
- Investigators and law enforcement: The FBI’s alert and the published wallet list are intended to create choke points — freezes and seizures — but investigators will face the challenge of tracking assets pushed through DeFi and swap services. Elliptic’s verification of $2.85 billion frozen or seized demonstrates progress but also leaves billions still at risk of laundering.
- Customers and counterparties: Even with Binance’s guarantee that customers will be made whole, the $3.64 billion in outflows shows user confidence can be fragile after a breach. Limited liquidity in some tokens may mean replenishment looks different across asset types and could affect withdrawal experience and market prices for the harder-to-replace tokens.
The immediate aftermath is thus twofold: Binance has largely backstopped customer balances by deploying billions from its own coffers, while investigators and blockchain trackers race to follow billions of dollars as the attackers try to funnel funds into harder-to-trace channels. The FBI’s public naming of TraderTraitor and the release of wallet addresses aim to shrink those channels — but as the sequence of freezes, swaps, and seizures shows, visibility on-chain is only the beginning of a complex, international effort to recover assets and disrupt laundering pathways.
Original reporting: https://www.theregister.com/security/2026/11/02/fbi-pins-63b-binance-crypto-heist-on-north-korean-hackers/5306889
