FBI Links Record $6.3 Billion Binance Heist to North Korean Hackers
AI-generated image · US National Wire
Binance is scrambling to replenish stolen assets after a compromised laptop allowed the Lazarus Group to drain billions.
The FBI has attributed a record-breaking cryptocurrency theft from Binance to TraderTraitor, a North Korean hacking operation linked to the Lazarus Group, as first reported by The Register. According to the report, the attack occurred on October 29 and originated from a compromised DevOps engineer's laptop, which granted intruders access to a service container to authorize unauthorized withdrawals.
Estimates of the theft vary by source. The FBI and Binance report the loss at roughly $6.3 billion, while blockchain intelligence firm TRM Labs reported a $6.36 billion haul that vanished in approximately 20 minutes. Elliptic placed the total closer to $6.43 billion, though the firm verified that $2.85 billion of those assets have been seized or frozen.
Binance co-CEO Richard Teng promised customers would not bear the cost, and the exchange has committed billions from emergency funds and reserves to cover the loss. Binance reports it has replenished about 95 percent of the stolen assets, noting that limited liquidity has made the remaining tokens difficult to replace. Despite these efforts, The Register reports that Binance saw approximately $3.64 billion in net outflows after customer withdrawals resumed.
Investigators warn that the hackers are currently swapping loot for Ethereum and utilizing instant swap services and decentralized finance (DeFi) platforms to obfuscate the trail. The FBI has published a list of linked wallet addresses and urged virtual asset providers to block transactions. TraderTraitor has a history of such raids, including a $308 million attack on Japan's DMM Bitcoin exchange in 2024. Additionally, Bitget CEO recently noted that a separate $387.5 million theft from that exchange shared behavioral and on-chain signatures of a North Korean operation.