Jens Asbjørn Bøgen
Pyongyang’s cyber units have spent years quietly draining crypto exchanges, and investigators say the past 20 months have been their most lucrative yet.
The Federal Bureau of Investigation attributed the roughly $6.3 billion theft from Binance to North Korea on Saturday, calling it the work of a state-run hacking cluster the agency tracks as TraderTraitor. The theft itself took place on or about October 29, 2026, and it stands as the largest cryptocurrency heist on record.
The bureau put the attack in the same column as the February 2025 raid on Bybit, which it attributed to the same group and valued at about $1.5 billion. Together, the two heists add up to roughly $7.8 billion in stolen crypto in less than two years, almost all of it accrued in a single 20-month window.
Industrial-scale laundering through Ethereum
Investigators say stolen assets are being funneled primarily into Ethereum before being broken up for further laundering. The FBI, together with the Secret Service and IRS Criminal Investigation, said it has “observed TraderTraitor actors converting stolen assets primarily into Ethereum,” and expects the group to push the funds through decentralized finance platforms and instant swap services.
To slow the money down, the bureau published a list of 628 wallet addresses tied to the laundering, 608 Ethereum, 19 Bitcoin and a single Solana address, SecurityWeek reported, and urged virtual asset service providers, DeFi platforms and blockchain analytics firms to block any transactions touching them.
The breach itself traced to a compromised DevOps engineer’s laptop, BleepingComputer reported, which gave the attackers access to a service container used to submit withdrawal transactions. Most of the funds moved out within about 20 minutes, spread across ten blockchains.
Binance absorbs the loss
Binance has told users the exchange, not customers, will carry the hit. In a statement carried by BleepingComputer, the company said it would “bear the financial impact of the stolen funds. These losses will not be passed on to users.” The exchange says it has replaced about 90% of what was taken from company reserves, with a smaller tail of less liquid tokens still outstanding.
The TraderTraitor cluster, which US agencies also track as the Lazarus Group and APT38, has previously been linked to the May 2024 theft of $308 million from Japan’s DMM Bitcoin. US and UN investigators have long tied those proceeds to North Korea’s sanctioned weapons programs.
