FBI: North Korean TraderTraitor behind $6.3B hack
The U.S. FBI confirmed North Korea was behind the record-breaking $6.3 billion Binance hack, attributing it to the elite hacking unit ‘TraderTraitor’. S. Federal Bureau of Investigation (FBI) has officially confirmed that North Korea was behind the record-breaking $6.3 billion Binance hack. The agency attributed the attack to an elite hacking unit known as “TraderTraitor,” a subunit of the infamous state-sponsored Lazarus Group.
In a statement released Saturday, October 31, the FBI announced its findings following the massive theft from the world’s largest cryptocurrency exchange on or about October 29. The bureau is now urging the global crypto community to help contain the fallout by blocking a vast network of digital wallets.
North Korean cyberattacks are on the rise
The scale of the theft is the largest on record in the history of digital assets. The FBI’s statement revealed it is tracking the stolen funds and has identified over 600 Ethereum addresses, nearly 20 Bitcoin addresses, and a single Solana address tied to the perpetrators. The agency is calling on all private sector entities to take action.
“The FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets,” the FBI stated.
Immediately following the breach, Binance took steps to secure its platform, including a temporary suspension of withdrawals. Co-CEO Richard Teng assured users that the exchange would cover all losses. “We’ve now replenished 90 per cent of the stolen assets, and we’re committed to covering the remaining 10 per cent,” Teng stated on X.
“Our users will not bear the financial impact of this incident.” The exchange has since been working on resuming user withdrawals.
Quick collaboration between the exchange and stablecoin issuers proved crucial in mitigating the damage. Tether and World Liberty Financial, among others, successfully froze approximately $2.67 billion of the stolen assets. Additionally, Arbitrum’s Security Council locked down 8,426 ETH and 74.6 million ARB, preventing the hackers from cashing out a significant portion of their haul.
The sophisticated attack vector
Initial reports suggest a highly sophisticated, multi-stage attack. According to blockchain intelligence firm TRM Labs, the breach likely began by compromising the hot wallet signing infrastructure. The attackers reportedly used an EIP-7702 delegation to effectively seize control of a Binance hot wallet, executing the theft with 50 pre-signed authorizations they had prepared in advance.
This wasn’t a simple smash-and-grab. The attackers moved with precision, draining the funds in just 20 minutes starting at 20:05 UTC. Binance’s initial investigation pointed to a compromised laptop belonging to an engineer as a potential entry point, highlighting the constant threat of social engineering and single-point-of-failure risks even at major institutions.
Now, the race is on to stop the laundering of the remaining $2.4 billion in unfrozen assets, which includes over 420,000 ETH and 18,270 BTC. Jonathan Levin, co-founder of Chainalysis, warned that the operation is far from over. He noted that while the FBI listed hundreds of addresses, the attackers have already used “thousands of addresses.”
“We anticipate this will become tens of thousands over the coming weeks as money is transferred through a broader money laundering network,” Levin said. He explained that the sheer size of the loot overwhelms typical laundering channels, forcing the hackers to use “novel automated laundering mechanisms” and a wider array of DeFi services like bridges and swaps.
North Korea’s prolific cybercrime division
For security analysts, the attribution to North Korea’s TraderTraitor and Lazarus Group is no surprise. These state-backed entities have become a primary revenue generator for the heavily sanctioned regime in Pyongyang, with stolen crypto directly funding its weapons programs. This is not their first multi-million dollar heist; it’s just the biggest.
The Lazarus Group has a long and notorious history of targeting the crypto space. They were confirmed by the FBI to be behind the $625 million Ronin Bridge hack in April 2022, which devastated the Axie Infinity ecosystem. They also perpetrated the $100 million Harmony Horizon bridge hack in June 2022 and a $41 million theft from Stake.com in September 2023.
Their track record demonstrates a consistent and evolving threat to the entire digital asset industry. The U.S. government has been actively trying to disrupt these operations, with a recent crackdown on North Korean crypto brokers who facilitate the money laundering network.
The motivation is clear: a desperate need for foreign currency to prop up a struggling economy and circumvent international sanctions. By targeting decentralized and often poorly secured financial systems, North Korea has found a lifeline that is difficult for global authorities to sever completely.
Implications for the future of crypto security
The Binance hack is a watershed moment for the crypto industry, exposing both its greatest weaknesses and surprising strengths. The incident highlights the immense risk posed by centralized honeypots, where a single breach can lead to catastrophic losses. Even the world’s largest exchange, which has faced a separate investigation in other jurisdictions, remains a prime target.
Yet, the incident also demonstrated the power of a coordinated response. The ability of stablecoin issuers to freeze nearly half the stolen funds shows that certain centralized checkpoints within the DeFi ecosystem can act as a powerful backstop against theft. It presents a paradox: the very centralization that critics decry may have been the industry’s saving grace in this instance.
The FBI’s direct plea to decentralized finance operators marks a significant shift in strategy. It acknowledges that law enforcement cannot act alone. Containing state-sponsored cybercrime in the blockchain era requires a real-time, public-private partnership that extends to the very infrastructure of DeFi.
Ultimately, the attack serves as a stark reminder that as the value locked in crypto grows, so too does the incentive for sophisticated state actors to exploit its vulnerabilities. For every dollar frozen and every wallet blocked, the cat-and-mouse game between hackers and defenders continues on-chain, with billions of dollars at stake.