This is a new development in a story we reported earlier: FBI, Secret Service and IRS attribute $6.43 billion Binance heist to TraderTraitor. Earlier in this story: Binance reports $6.3 billion crypto breach, suspends deposits and withdrawals.
Key facts
- TraderTraitor, also known as Lazarus Group, Jade Sleet, UNC4899, and Slow Pisces, has conducted multiple state-funded crypto heists, including the $1.5 billion Bybit hack in February 2025.
- Binance replaced approximately 95% of the stolen assets using its corporate treasury, futures insurance fund, and Secure Asset Fund for Users (SAFU).
- Binance confirmed that balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed, as verified on its proof-of-reserves site.
- Binance initially suspected a compromised DevOps engineer’s laptop as the breach entry point but later uncovered additional points of breach, indicating a complex attack.
Binance resumed withdrawals on Nov. 1, 2026, in a development after the FBI attributed the $6.3 billion cryptocurrency theft to North Korea’s TraderTraitor APT group. The heist occurred on or about Oct. 29, 2026, when attackers moved approximately $6.36 billion across ten blockchains in roughly 20 minutes.
Withdrawals resumed in phases, starting with Bitcoin, then USDC, USDT, and ETH on Ethereum, and USDC, USDT, and BNB on BNB Smart Chain. Binance co-CEO Richard Teng announced the phased resumption on X on Nov. 1, emphasizing a careful approach to safety and security. Fiat withdrawals for USD, UAE dirham, Vietnamese dong, Philippine peso, and Indonesian rupiah resumed on Nov. 2, bringing the total number of supported fiat currencies to 28. Users withdrew $3.4 billion from Binance after withdrawals resumed following the heist, according to France 24.
Binance initially suspected a compromised DevOps engineer’s laptop as the breach entry point but later uncovered additional points of breach, indicating a complex attack.
Binance replaced approximately 95% of the stolen assets using its corporate treasury, futures insurance fund, and Secure Asset Fund for Users (SAFU). The remaining 5% consists of less liquid tokens ranked outside the top ten, which the exchange is purchasing through market and over-the-counter channels. Binance told BleepingComputer that it will bear the financial impact of the stolen funds and that losses will not be passed on to users.
The exchange confirmed that balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed, as verified on its proof-of-reserves site. Users can check the backing status on the platform.
Scammers attempted to exploit the withdrawal pause by circulating fake posts claiming Binance would pay a $150 compensation reward to affected users. Binance warned users to ignore such posts and to verify information only through official channels. Randy, a member of Binance’s global affiliates team, posted on X that the screenshots were fake, and co-CEO Changpeng Zhao told followers that scammers were on overdrive and users should be careful. “Scammers on over drive now.
Be careful,” Zhao wrote.
The FBI listed 628 cryptocurrency addresses tied to the theft: 608 Ethereum wallets, 19 Bitcoin wallets, and one Solana wallet, and urged providers to block transactions linked to them. The agency observed TraderTraitor converting stolen assets primarily into Ethereum and expects further laundering through decentralized finance (DeFi) platforms and instant swap services. The FBI specifically urged THORNode operators, RPC node operators, instant exchanges, DeFi services, and blockchain analytics firms to block transactions linked to TraderTraitor laundering addresses.
Tether and Circle helped freeze close to $3 billion of the stolen funds within the first day after the heist, while Elliptic reported that approximately $2.9 billion were frozen or seized, leaving around $3.3 billion outside the reach of issuers. Elliptic estimated the attacker still controls around $3.25 billion of unfreezable assets across more than 800 addresses, including about 584,000 ETH worth $1.32 billion, 18,327 BTC worth $1.42 billion, and 233 million XRP. The firm noted that stolen TRX was laundered through bridges onto Ethereum and split across hundreds of fresh wallets, while XRP, SOL, and NEAR worth around $439 million have not moved since the theft.
TraderTraitor, also known as Lazarus Group, Jade Sleet, UNC4899, and Slow Pisces, is a North Korean state-sponsored group linked to multiple crypto heists, according to Help Net Security and Infosecurity Magazine. The group has stolen $1.5 billion from Bybit in February 2025, $308 million from DMM, $60 million from Alphapo, $37 million from CoinsPaid, $100 million from Atomic Wallet, $387.5 million from Bitget in September 2026, and $280 million from Drift in April 2026, as reported by Infosecurity Magazine and BleepingComputer. By early October 2025, Elliptic had linked more than $2 billion in stolen cryptocurrency to North Korea for that year alone, mainly from the Bybit heist and more than thirty other hacks, with funds believed to support nuclear weapons and missile programs, Help Net Security reported.
BleepingComputer reports that the group uses Operation DreamJob, where hackers impersonate recruiters to trick employees into installing malware. In the DMM attack, which BleepingComputer detailed, attackers posed as a LinkedIn recruiter to deceive an employee at wallet provider Ginco into executing malicious Python code. The Bybit heist, also reported by BleepingComputer, stemmed from a compromised Safe{Wallet} developer’s computer, which allowed hackers to redirect $1.5 billion. The Drift attack, according to BleepingComputer, involved a six-month social engineering operation, with attackers meeting contributors in person at conferences and compromising devices through a malicious code repository or TestFlight application.
Elliptic reported that the Binance attack involved several individuals and included a self-destruct feature that erased tools and evidence during execution, complicating forensic investigations, according to Infosecurity Magazine. Help Net Security and BleepingComputer report that blockchain intelligence firms TRM Labs and Chainalysis were the first to link the Binance heist to TraderTraitor, doing so within a day of the Oct. 29 attack.
BNB edged up over 1% on Sunday after the FBI attribution and was trading around $711, up over 2% in the past 24 hours, with bullish retail sentiment on Stocktwits, Yahoo! Finance reported. Changpeng Zhao credited the FBI, Secret Service, and IRS for tracking and freezing stolen funds, stating these agencies played a major role in preventing further Bitcoin price declines. “Tracking, freezing, etc.,” Zhao said.
Binance warned users to expect delays and slower processing during heavy traffic and to try a failed withdrawal again after a short wait. The exchange said it will release a post-incident report after completing its internal investigation. Binance also acknowledged the concern and disruption caused by the suspension, promising to monitor closely as services returned in phases.
Join the discussion