FBI, Secret Service and IRS attribute $6.43 billion Binance heist to TraderTraitor

This is a new development in a story we reported earlier: Binance reports $6.3 billion crypto breach, suspends deposits and withdrawals.

The FBI, Secret Service and IRS Criminal Investigation formally attributed the $6.43 billion Binance crypto heist to TraderTraitor, a North Korea-aligned hacking group, identifying it as responsible for the October 29 attack on the exchange.

The agencies made the formal attribution on November 1, after the FBI issued a public security alert on October 31 that marked the first official U.S. government confirmation that North Korean actors carried out the intrusion. The bureau’s public alert followed private blockchain firm attributions and formalized the U.S. government’s conclusion that North Korean actors were responsible, issued two days after the October 29 attack.

TraderTraitor, which the FBI tracks alongside the names Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899, has targeted cryptocurrency and Web3 (decentralized internet) industries since at least 2020. It orchestrates crypto thefts through malware-laced applications and social engineering.

In this campaign, the group used trojanized Terraform providers to deliver the FLATROOF implant and ROOFDECK backdoor to developers. It builds recruitment-themed lures with AI (artificial intelligence) to impersonate recruiters at spoofed companies targeting cybersecurity, AI and blockchain professionals. The malware collects sensitive data and provides remote access to compromised systems.

TraderTraitor also compromises developer laptops and deploys malware that deletes evidence of activity, complicating investigations.

The Binance intrusion exploited EIP-7702 delegation on Ethereum to turn a hot wallet into a sweeper, using 50 pre-signed authorizations. The method indicates a compromise of Binance’s hot wallet signing infrastructure.

Stolen assets moved across 11 blockchains, with 82% on Ethereum and Bitcoin, totaling $6.43 billion according to Elliptic. Tether, Circle, Ripple, Arbitrum and Optimism have frozen $2.85 billion of the stolen assets on-chain.

Elliptic estimates the remaining funds at $2.4 billion in ETH and BTC beyond immediate issuer control. The FBI urged THORChain to block stolen funds to prevent laundering through its network.

The bureau also provided wallet addresses linked to the laundering operation and urged crypto service providers to block transactions from those addresses. TraderTraitor converted stolen assets primarily into Ethereum and plans to launder them further using decentralized finance, or DeFi, and instant swap services.

The group now holds over 420,000 ETH and 18,270 BTC. Its laundering includes selling USDT to market makers and borrowing ETH against USDT on Aave to evade issuer freezes.

Binance resumed phase one of withdrawals on November 1 after pausing them following the heist, implementing precautionary security measures and verifying affected services before restoring withdrawals.

We aim to restore withdrawals progressively as we complete security and readiness checks. Deposit services remain open and are not affected by the incident.

Binance, The Hacker News

TraderTraitor’s previous targets include DMM Bitcoin, Bybit, KelpDAO and Bitget, all linked to North Korean cyber operations. The group’s modus operandi involves social engineering and malware distribution. Elliptic says North Korea-linked actors stole more than $6.5 billion in crypto assets in recent years, and the Binance heist surpasses the $1.46 billion Bybit theft from February 2025 to become the largest cryptocurrency theft in history.