On this page (6 sections)
The FBI and the U.S. Secret Service say North Korea's TraderTraitor hacking group is responsible for the theft of more than $6 billion in digital assets from Binance, the world's biggest cryptocurrency exchange. The Hacker News describes it as the largest cryptocurrency theft in history. Binance shut down for several days, then restored deposits and withdrawals.
This is not a website vulnerability, and there is no patch to apply. It still matters to developers, agencies and hosting administrators, because the group's documented methods target the people who build and run technical infrastructure. Details of how Binance was breached remain incomplete.
What happened
According to The Record, the FBI and Secret Service said over the weekend that TraderTraitor was behind the theft and urged the crypto industry to stop the funds from being laundered. The agencies asked exchanges, DeFi companies and other operators to block transactions with or derived from addresses the group is using, and the FBI provided a list of those addresses.
The FBI said it has seen the actors converting stolen assets primarily into Ethereum (ETH), and expects them to be laundered further through DeFi and instant swap services. The Hacker News reports the funds were stolen across 11 blockchains, 82% of them on Ethereum and Bitcoin, and that the haul exceeds the $1.46 billion taken from Bybit in February 2025.
Binance paused withdrawals, then began restoring them in phases on November 1, 2026. The Hacker News later updated its report to say withdrawals had resumed on all 15 networks. The Record reports that Binance used its reserve funds to replace the stolen coins.
What is confirmed and what is not
Everything in this story comes from news reporting. Our research found no original FBI statement, Binance incident report or vendor advisory, so treat the details below as reported claims. The two articles are separate reports, but both rely on the same official statements.
| Topic | What is reported | Status |
|---|---|---|
| Total stolen | Over $6.3 billion (The Record) vs $6.43 billion (The Hacker News) | Figures differ slightly; exact total unconfirmed |
| Frozen funds | About $3 billion (blockchain security experts, via The Record) vs $2.85 billion frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism (The Hacker News) | Approximate and still changing |
| How attackers got in | Binance first pointed to a compromised engineer laptop, then said further investigation found additional points of breach | Incomplete; no full root cause in our sources |
| Attacker tooling | Binance CEO Richard Teng said the attacker used a self-destruct mechanism that destroyed tooling and traces | Company statement, not independently verified |
| Attribution | FBI, Secret Service and IRS-CI attribute the theft to TraderTraitor | Official attribution; supporting evidence not included in our sources |
How TraderTraitor is known to operate
The Hacker News describes TraderTraitor as a North Korea-aligned group active since at least 2020, which has been attributed to heists targeting DMM Bitcoin, Bybit, KelpDAO and Bitget. It is known for tricking victims into downloading malware-laced applications.
The same article summarizes reports from SentinelOne, Zscaler ThreatLabz and Microsoft. They describe the group using trojanized Terraform providers as a distribution vector. In that chain, a poisoned provider delivers a Bash loader that selects and downloads malware tailored to the victim's operating system, including a cross-platform implant called FLATROOF, which steals data with a Python-based information stealer before dropping the ROOFDECK backdoor for full remote control. Microsoft also described the group posing as recruiters for a spoofed AI-powered blockchain intelligence company, using tailored domains and social media profiles to schedule interviews.
Who is realistically exposed
Most website owners are not the target of a nation-state theft of this scale. The relevant exposure is indirect:
- Developers and DevOps staff who receive unsolicited job offers, coding tests or interview tasks that involve running code.
- Teams that install third-party Terraform providers, packages or extensions without verifying their source.
- Exchanges, wallets, DeFi services and payment businesses that need to screen incoming funds against the FBI's address list.
- Agencies and hosts whose engineers hold cloud, repository and deployment credentials for many clients.
Laundering also matters for screening. Elliptic warned that the laundering is automated and that a wallet which clears today can receive funds from this cluster hours later, so one-off checks and static lists will not catch it.
What to do now
These steps follow from the group's reported methods. They are general hardening, not a fix for a specific flaw.
0 of 8 done
Detection and monitoring
Outside-in monitoring cannot see a compromised laptop, but it can help you notice downstream effects of stolen access, such as unexpected changes to your site, DNS or certificates. A security scan of your verified site and monitoring for DNS and certificate changes are useful baselines. Neither detects this specific campaign, and neither replaces endpoint security and account hygiene. For related guidance, see what to do if your website is hacked and how to check if a website is hacked.
Watch for official technical indicators from the investigation. Until they are published, avoid acting on unverified indicator lists circulating on social media.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.