Binance Crypto $6.3 Billion Heist: What to Know About TraderTraitor, the North Korean Hacking Group Accused of Hacking | Today’s news

The Federal Bureau of Investigation (FBI) has accused a North Korean hacking group known as TraderTraitor of stealing more than $6.3 billion in virtual assets from cryptocurrency exchange Binance in what analysts say could be one of the biggest financial heists ever.

The FBI said on Saturday that TraderTraitor was responsible for the attack, which took place around October 29, 2026. According to US blockchain analytics firms TRM Labs and Chainalysis, most of the theft reportedly unfolded in about 20 minutes.

The incident focused on North Korea’s alleged use of cyber operations to steal cryptocurrency and generate revenue amid extensive international sanctions imposed on the country over its nuclear and missile programs.

Quick answers to key questions

•5 QUESTIONS

TraderTraitor is the name for a North Korean-backed cyber unit accused of stealing cryptocurrencies and laundering stolen digital assets. The FBI accused her of stealing more than $6.3 billion in virtual assets from Binance.

Binance’s CEO described the security breach as a complex attack involving a compromised laptop and malicious software. The malware was reportedly designed to erase evidence, and the exact method used to access Binance’s systems remains unclear.

The FBI said TraderTraitor was converting stolen assets into ether and warned that the group could use decentralized financial platforms and instant swap services to launder them. Blockchain firms reported fast transfers and signs of automation.

Binance said it would bear the financial fallout and set aside about $6.34 billion to cover the stolen assets. It used funds from its SAFU, Futures Insurance Fund and corporate treasury to purchase replacement tokens.

Yes. TraderTraitor was also accused of stealing about $1.5 billion worth of cryptocurrency from Bybit in February 2025.

Binance, the world’s largest cryptocurrency exchange by daily trading volume, said it would bear the financial impact of the theft. The company said it had covered about 95% of the stolen assets by purchasing replacement tokens and resumed withdrawals in phases on Sunday.

What is TraderTraitor?

TraderTraitor is the name of a North Korean-backed cyber unit accused of stealing cryptocurrencies and laundering stolen digital assets.

The FBI named the group responsible for the Binance hack and said law enforcement watched its members convert stolen assets into ether, a cryptocurrency linked to the Ethereum blockchain.

The agency warned that stolen funds could be subject to further laundering through decentralized finance (DeFi) platforms and instant swap services. It also called on private sector organizations to block transactions involving cryptocurrency addresses used by the group.

TraderTraitor is believed to be affiliated with North Korea’s Lazarus Group, a hacking organization that has been linked to several high-profile cyber attacks over the years.

What is Lazarus Group’s connection to TraderTraitor?

The Lazarus Group is a North Korean-linked hacking organization that has been accused of carrying out cyber attacks against businesses, financial institutions and government organizations.

The group gained international notoriety in 2014 when they were accused of hacking Sony Pictures Entertainment. The attack was widely linked to the release of The Interview, a comedy film that mocked North Korean leader Kim Jong-un.

Lazarus has also been linked to large-scale cryptocurrency thefts, with cyber investigators saying North Korea-linked hackers are increasingly targeting digital asset platforms to raise funds.

TraderTraitor is believed to be part of this wider network of North Korean cyber operations.

TraderTraitor accused of Bybit hack before Binance theft

TraderTraitor was also accused of stealing approximately $1.5 billion in cryptocurrency from Dubai’s Bybit exchange in February 2025.

The group is now accused of carrying out the much larger Binance attack, which involved the theft of more than $6.3 billion in virtual assets.

The two incidents have renewed concerns about the ability of cyber groups linked to North Korea to target major cryptocurrency exchanges and move stolen funds through digital asset networks.

According to TRM Labs, attackers stole around $2.9 billion worth of cryptocurrencies in nearly 150 attacks last year, underscoring the growing scope of security threats facing the digital asset industry.

How TraderTraitor allegedly stole $6.3 billion from Binance?

The Binance breach was described by exchange co-CEO Richard Teng as a complex attack involving a compromised laptop and malicious software.

The malware was reportedly designed to erase evidence of its activity, making it difficult for investigators to trace the breach and determine how the attack unfolded.

How Binance Recovers Stolen Cryptocurrency?

Binance said it would absorb the financial impact of the theft rather than pass the losses on to customers.

The exchange said it set aside about $6.34 billion in corporate funds to cover the stolen assets. The company also said it had recovered or located approximately $3 billion in affected assets as of Friday with the help of industry partners.

The company used funds from its Secure Asset Fund for Users (SAFU), Futures Insurance Fund and corporate treasury to purchase replacement tokens.

Binance said it had covered around 95% of the stolen assets, while the remainder was less liquid cryptocurrencies that may take longer to recover in the required quantities.

The exchange also began reopening withdrawals in phases on Sunday, initially restoring access to 15 tokens, including Bitcoin, Ether, Dogecoin and some USDC and USDT stablecoins.

However, the attack caused an initial spike in customer choice. DefiLlama reported that Binance saw a net outflow of more than $3.5 billion on Sunday. The exchange said download activity has since stabilized.

Trump questions North Korea’s involvement

While the FBI directly attributed the Binance theft to North Korea’s TraderTraitor unit, US President Donald Trump expressed uncertainty about Pyongyang’s involvement.

“We don’t know if it’s North Korea — but if it is, we will talk to North Korea about it,” Trump told reporters on Saturday.

(With AFP, Reuters inputs)

Read also | Binance hack: Tether, Circle freeze $2.4 billion in crypto assets; Bitcoin falls