Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

FBI Ties North Korea's TraderTraitor to Record $6.43 Billion Binance Heist

US authorities have attributed the theft of $6.43 billion in crypto assets from Binance to TraderTraitor, the North Korea-aligned group — now the largest cryptocurrency theft on record.

4T4Tify Team4Tify
Nov 1, 2026·5 min read
FBI Ties North Korea's TraderTraitor to Record $6.43 Billion Binance Heist

FBI Ties North Korea's TraderTraitor to Record $6.43 Billion Binance Heist

The US Federal Bureau of Investigation has formally attributed the theft of roughly $6.43 billion in virtual assets from Binance to TraderTraitor, a North Korea-aligned hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899. That makes it the largest cryptocurrency theft ever recorded — more than four times the size of the previous record.

What happened

Working alongside the US Secret Service and the IRS Criminal Investigation unit, the FBI says it watched the attackers convert the stolen funds largely into Ether (ETH). Investigators expect the next step to be laundering through decentralized-finance protocols and instant swap services, and the Bureau has published a list of wallet addresses linked to the operation so exchanges and service providers can flag them.

Key figures from the incident:

  • $6.43 billion stolen across 11 blockchains, with about 82% held on Ethereum and Bitcoin.
  • Roughly $2.85 billion has already been frozen on-chain by stablecoin issuers and networks including Tether, Circle, Ripple, Arbitrum and Optimism.
  • The haul dwarfs the $1.46 billion Bybit theft of February 2025, previously the record.
  • On its own, it nearly doubles the total crypto believed to have been stolen by North Korean actors in recent years, estimated at more than $6.5 billion before this incident.

Binance paused withdrawals after the breach and has started a phased restoration, reopening the first wave in a limited morning window (UTC) while security and readiness checks continue. Deposits were not affected.

Who is TraderTraitor

TraderTraitor has been active since at least 2020 and has a long track record of targeting the Web3 industry, typically by persuading employees to install malware-laced applications. The group has previously been linked to thefts from DMM Bitcoin, Bybit, KelpDAO and Bitget.

Its playbook keeps evolving. Recent activity shows the group:

  • Poisoning developer tooling — trojanized Terraform providers deliver a Bash loader that fetches malware tailored to the victim's operating system. That includes a cross-platform implant called FLATROOF, which uses a Python-based infostealer to siphon sensitive data, before finally deploying the ROOFDECK backdoor for full remote control. Windows, macOS and Linux are all in scope.
  • Running fake companies and job offers — front companies, tailored domains, social media profiles and convincing recruiter personas (including a spoofed AI-powered blockchain intelligence firm) are used to approach people in crypto, AI, blockchain and talent recruitment, then lure them into running malicious code as part of a "technical test."
  • Using AI to scale deception — generative AI helps craft persuasive lures and fake personas and helps the operators evade detection.

These tactics mirror other North Korean campaigns built around recruitment lures, such as Operation Dream Job and Contagious Interview.

Why it matters

The breach shows that the weakest link is rarely the blockchain itself — it is the people, laptops and build pipelines around it. A single developer who installs a poisoned infrastructure-as-code provider, or completes a fake coding assignment, can hand attackers a foothold into systems that control billions. And with defenders freezing funds faster, attackers are pushing harder to launder quickly — so detection speed is everything.

What to do

  • Lock down your supply chain. Pin Terraform providers and modules to verified sources and checksums, mirror them internally, and review any new or unfamiliar provider before it reaches a CI/CD pipeline.
  • Treat unsolicited job offers and "coding tests" as a threat vector. Never run recruiter-supplied code on a work machine; use disposable, isolated environments if candidates must be assessed.
  • Isolate signing and treasury operations. Keep hot-wallet keys, signing infrastructure and admin consoles on hardened, dedicated devices with hardware-backed MFA and multi-party approval.
  • Hunt for the published indicators. Screen counterparties and transaction flows against the wallet addresses released by US authorities, and alert on unusual outbound transfers.
  • Watch endpoints across all platforms. Ensure EDR coverage extends to the macOS and Linux machines developers actually use, with alerting on unexpected Bash loaders, Python processes and new persistence.

Poisoned providers and dependencies are exactly the kind of problem that slips past casual review. Our team's AI-assisted code review inspects source repositories, infrastructure-as-code and third-party dependencies to surface untrusted components, hard-coded secrets and risky changes before they ship — catching this class of supply-chain compromise early.

SHARE